Keeping personal data secure: what Article 32 requires

Part of the guide UK GDPR’s seven principles, in plain English

Start with the risk to people

The organisation deciding why and how data is used is called a controller. A processor handles data on its behalf. Article 32 requires both to put appropriate security measures in place.

Look at the data, what you do with it and the harm people could face if something goes wrong. The law also takes account of available technology and the cost of putting measures in place. The result must still be security that is appropriate to the risk.

Security reaches beyond computers. The ICO includes physical measures, such as controlling access to premises, and organisational measures, such as clear staff procedures.

What does suitable security look like?

People should only be able to access, change, share or delete data within the authority you give them. Records also need to remain accurate, complete and usable.

These examples turn those aims into questions for a team. They are prompts to adapt to the actual data and risks, not a fixed list for every organisation.

Can you restore the data when something goes wrong?

Article 32 includes the ability to restore access to personal data in a timely way after a physical or technical incident. Think about recovery as well as preventing unauthorised access.

Cybersecurity specialist Lisa Forte makes a useful point about relying on several layers of protection. Her LinkedIn comment is an expert view, not a separate legal requirement.

The ICO checklist below puts recovery beside testing. The useful question is whether the measures work when needed, and what happens after a test finds a problem.

The ICO checklist connects recovery with regular testing and action.

How often should you test security?

Testing needs to be regular. Its type and frequency depend on your organisation and the data it handles. The ICO says to document the results and act on recommendations, or record valid reasons for another approach with appropriate safeguards.

For example, a team could plan a recovery exercise, record what it could restore, and assign any fixes it finds. This is an example exercise to discuss, not a claim about how often your system needs testing.

What if a supplier holds the records?

If you choose a processor, the ICO says it must provide sufficient guarantees about security measures. A useful buying discussion asks what the supplier protects, what it tests and what evidence it can show.

The ICO marks its security guidance as under review after the UK’s Data (Use and Access) Act. The risk, recovery and testing duties above are also set out in the UK GDPR text.

What to do

1. Describe the personal data and the risks to people.
2. Check access, physical protection and staff procedures.
3. Plan how access would be restored after an incident.
4. Test the measures, record results and follow up findings.
5. Ask a processor for evidence of suitable security.

Common questions

Is Article 32 just about IT?

No. It covers technical and organisational measures. The ICO also includes physical security and what staff do when handling data.

Do we have to encrypt personal data?

The ICO recommends encryption for personal data stored or sent over the internet. It should be part of a policy that considers the remaining risks too. Assess what is appropriate for the data and its use, rather than treating encryption as the whole security plan.

Where next

• Who is a data controller, and who is a processor?
• Article 28: what must a processor contract say?
• Incident response plan: what to write down
• When must you report a personal data breach?
• Data protection training: what should staff learn?

This is an independent editorial guide, not legal advice.