# Security of processing 32(2) — GDPR — provision context

> Focused context for a single provision (32(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-32#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Security of processing** (GDPR, full article: https://overview.legal/laws/gdpr/art-32).

## Provision text

### 32(2)

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.


## Topics on this provision

- **Right of Access** — https://overview.legal/topics/inzagerecht
  Data subject right to access their personal data
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons

## Cited by (exact-provision citations)

- **X - BA-6S/221/2019** (case-law) — https://overview.legal/posts/132105
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** (case-law) — https://overview.legal/posts/132130
- **Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) –** ¶116 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132130
- **X - BA-6S/221/2019** ¶41 (case-law, Regional Administrative Court Bratislava) — https://overview.legal/posts/132105
- **EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro** (guidance) — https://overview.legal/posts/125823
- **EDPB Annual Report 2022** (guidance) — https://overview.legal/posts/125861
- **EDPB Annual Report 2021** (guidance) — https://overview.legal/posts/125941
- **EDPB Annual Report 2023** (guidance) — https://overview.legal/posts/125756
- **EDPB Annual Report 2025** (guidance) — https://overview.legal/posts/125683
- **Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria** (guidance) — https://overview.legal/posts/125759

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-32#par-2 · 2026-08-22