# Security of processing 32(1) — GDPR — provision context

> Focused context for a single provision (32(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-32#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Security of processing** (GDPR, full article: https://overview.legal/laws/gdpr/art-32).

## Provision text

### 32(1)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

a) the pseudonymisation and encryption of personal data;
b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **X - BA-6S/221/2019** (case-law) — https://overview.legal/posts/132105
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** (case-law) — https://overview.legal/posts/132130
- **SG Nürnberg - S 5 SF 65/24 DS** (case-law) — https://overview.legal/posts/122874
- **Judgment of the Court (Third Chamber) of 21 December 2023.#ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning heal** (case-law) — https://overview.legal/posts/132276
- **VG Stuttgart - 1 K 12737/25** (case-law) — https://overview.legal/posts/184726
- **Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval** (case-law) — https://overview.legal/posts/132271
- **VB v Natsionalna agentsia za prihodite** (case-law) — https://overview.legal/posts/51485
- **Meta Platforms and Others v Bundeskartellamt** (case-law) — https://overview.legal/posts/51482
- **VB v Natsionalna agentsia za prihodite** ¶52 (case-law, CJEU) — https://overview.legal/posts/51485
- **Judgment of the Court (Third Chamber) of 21 December 2023.#ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning heal** ¶68 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132276
- **VB v Natsionalna agentsia za prihodite** ¶43 (case-law, CJEU) — https://overview.legal/posts/51485
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** ¶117 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132130

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-32#par-1 · 2026-08-22