Security

Legal Framework

Security of personal data is governed primarily by Article 5(1)(f), which requires data to be "processed in a manner that ensures appropriate security," and Article 25, which mandates data protection by design and by default. Although Article 32 (Security of processing) is not provided in full here, it is the operational core of the security obligation and is cited consistently across CJEU and national case law as the provision that gives specific expression to the Article 5(1)(f) principle. Article 25 requires controllers to implement measures such as pseudonymisation both when determining processing means and during processing itself, taking into account state of the art, costs, and risk. Article 34(3)(a) provides a critical incentive: where encryption or equivalent measures render breached data unintelligible, the controller may be exempt from communicating the breach to data subjects.

"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures"
— GDPR Art. 5(1)(f)

Key Developments

The CJEU in ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein confirmed that Article 32 gives specific expression to Article 5(1)(f), requiring controllers to assess risk and implement measures proportionate to that risk:

"any controller of personal data is required to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular the pseudonymisation and encryption of such data and the ability to ensure, inter alia, the confidentiality and integrity of processing systems and services"
— ZQ v Medizinischer Dienst ¶68

The Irish DPC in the Permanent TSB decision emphasized that the GDPR does not prescribe specific measures but requires appropriateness:

"The GDPR does not identify specific technical and organisational measures that must be applied, nor does it set requirements in terms of the standard of such measures, provided that they are appropriate."
— Permanent TSB §39

The French CNIL's Hôpital privé de la Loire decision and the Irish DPC's Midlands Regional Hospital Tullamore decision both cited inadequate technical and organisational measures as the basis for enforcement. Recent IMY fines against Miljödata (€1.8 million after a ransomware breach) and AEPD sanctions against Vodafone España (€750,000 for inadequate processor oversight) confirm that ransomware exposure and processor-management failures are high-priority enforcement triggers.

Status of the Debate

This topic is contested in court. The boundaries of what constitutes "appropriate" security are actively litigated, with courts diverging on how to calibrate the risk-based standard. The CJEU's ruling in Schrems v Meta Platforms departed from European Commission v Republic of Poland, illustrating that the scope of protections owed in sensitive-data contexts remains unsettled:

"In particular, on the occasion of a panel discussion in which he participated in Vienna on 12 February 2019, at the invitation of the Representation of the European Commission in Austria, Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data."
— Schrems v Meta Platforms

While this split concerns contextual scope rather than the existence of the duty itself, it signals that courts are still defining the outer limits of security obligations in relation to sensitive data and third-party access.

Practical Guidance

• Conduct documented risk assessments for each processing activity, weighing state of the art, cost, and risk severity — the Article 32 factors consistently cited by courts and DPAs.
• Prioritize encryption and pseudonymisation — both are named in Article 32(1)(a) and serve as the benchmark for adequacy; encryption can also trigger the Article 34(3)(a) breach-notification exemption.
• Apply data protection by design and by default under Article 25, ensuring that only necessary data is accessible by default and that access controls prevent indefinite exposure.
• Monitor processor compliance rigorously — the AEPD's Vodafone sanction and IMY's Miljödata fine show that inadequate processor oversight is a standalone enforcement basis.
• Implement regular testing and evaluation of security measures per Article 32(1)(d) — ongoing assessment, not one-time implementation, is what enforcement authorities expect.