# Keeping personal data secure: what Article 32 requires

Connect the risks to people with the safeguards and checks your organisation uses.

The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026.

Part of the guide [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md).

**The short answer.** UK GDPR Article 32 requires security that fits the risk to people. It covers technical measures and how the organisation works. Both the organisation deciding how data is used and a supplier processing it on that organisation’s behalf have duties ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 9 October 2026).

## Start with the risk to people

The organisation deciding why and how data is used is called a controller. A processor handles data on its behalf. Article 32 requires both to put appropriate security measures in place ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 9 October 2026).

Look at the data, what you do with it and the harm people could face if something goes wrong. The law also takes account of available technology and the cost of putting measures in place. The result must still be security that is appropriate to the risk ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

Security reaches beyond computers. The ICO includes physical measures, such as controlling access to premises, and organisational measures, such as clear staff procedures ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).

## What does suitable security look like?

People should only be able to access, change, share or delete data within the authority you give them. Records also need to remain accurate, complete and usable ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).

These examples turn those aims into questions for a team. They are prompts to adapt to the actual data and risks, not a fixed list for every organisation ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

**Link a possible problem to a safeguard and a check**

| Possible problem | Example safeguard | Useful check |
| --- | --- | --- |
| Someone sees records they do not need. | Restrict access to the people who need it. | Can someone outside that role open the records? |
| Paper files can be taken from an open room. | Control access to the room or storage. | Who can get in, and when? |
| A device or system fails. | Keep an appropriate backup and recovery process. | Can the team restore access to usable records? |
| Staff follow different rules when sharing data. | Give staff clear procedures and training. | Can staff explain the approved way to share it? |

Source: ICO, A guide to data security, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 9 October 2026)

## Can you restore the data when something goes wrong?

Article 32 includes the ability to restore access to personal data in a timely way after a physical or technical incident. Think about recovery as well as preventing unauthorised access ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

Cybersecurity specialist Lisa Forte makes a useful point about relying on several layers of protection. Her LinkedIn comment is an expert view, not a separate legal requirement ([Lisa Forte on LinkedIn](https://www.linkedin.com/posts/lisa-forte_when-it-comes-to-cyber-security-be-careful-activity-7393964153272573952-EVB8), checked 9 October 2026).

The ICO checklist below puts recovery beside testing. The useful question is whether the measures work when needed, and what happens after a test finds a problem ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).

> "Resilience can never be one layer thick!"
> Lisa Forte, LinkedIn post excerpt
> Lisa Forte on LinkedIn, When it comes to cyber security be careful your assessed level of resilience isn’t based on sales promises from vendors. So often I see plans and playbooks based off of sales promises of tools and…, https://www.linkedin.com/posts/lisa-forte_when-it-comes-to-cyber-security-be-careful-activity-7393964153272573952-EVB8 (checked 9 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/lisa-forte_when-it-comes-to-cyber-security-be-careful-activity-7393964153272573952-EVB8)

**The ICO checklist connects recovery with regular testing and action.**

![ICO checklist items on restoring access through backups and regularly testing security measures.](https://theassurancedesk.com/images/editorial/ico-security-checklist.png)

The first item says an organisation should be able to restore access to personal data after an incident, for example through an appropriate backup process. The next says to test and review measures regularly, then act on results that reveal areas for improvement. The excerpt is text from the guidance, not a record of a completed assessment.

[Information Commission’s Office](/news/ico-becomes-the-information-commission), A guide to data security, latest listed update 19 May 2023, licensed under the Open Government Licence v3.0. Captured 9 October 2026.
Licence: https://ico.org.uk/global/copyright-and-re-use-of-materials/
Source: ICO, A guide to data security, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ (checked 9 October 2026); ICO, Copyright and re-use of materials, https://ico.org.uk/global/copyright-and-re-use-of-materials/ (checked 9 October 2026)

## How often should you test security?

Testing needs to be regular. Its type and frequency depend on your organisation and the data it handles. The ICO says to document the results and act on recommendations, or record valid reasons for another approach with appropriate safeguards ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

For example, a team could plan a recovery exercise, record what it could restore, and assign any fixes it finds. This is an example exercise to discuss, not a claim about how often your system needs testing.

**Make security an ongoing job**

1. Assess: Identify the data, its use and the risks to people.
2. Protect: Put suitable technical and organisational measures in place.
3. Test: Check whether the measures work and record the results.
4. Improve: Act on findings and keep the measures under review.

Use the test results to improve the measures. A written policy alone does not show that a recovery process works.

Source: ICO, A guide to data security, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 9 October 2026)

## What if a supplier holds the records?

If you choose a processor, the ICO says it must provide sufficient guarantees about security measures. A useful buying discussion asks what the supplier protects, what it tests and what evidence it can show ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).

The ICO marks its security guidance as under review after the UK’s Data (Use and Access) Act. The risk, recovery and testing duties above are also set out in the UK GDPR text ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

## What to do

1. Describe the personal data and the risks to people ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).
2. Check access, physical protection and staff procedures ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).
3. Plan how access would be restored after an incident ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).
4. Test the measures, record results and follow up findings ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).
5. Ask a processor for evidence of suitable security ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), checked 9 October 2026).

## Common questions

### Is Article 32 just about IT?

No. It covers technical and organisational measures. The ICO also includes physical security and what staff do when handling data ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

### Do we have to encrypt personal data?

The ICO recommends encryption for personal data stored or sent over the internet. It should be part of a policy that considers the remaining risks too. Assess what is appropriate for the data and its use, rather than treating encryption as the whole security plan ([ICO, A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 9 October 2026).

## Where next

- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md)
- [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff.md)

## Sources

- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/4 (checked 9 October 2026)
- ICO, A guide to data security: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ (checked 9 October 2026)
- Lisa Forte on LinkedIn: https://www.linkedin.com/posts/lisa-forte_when-it-comes-to-cyber-security-be-careful-activity-7393964153272573952-EVB8 (checked 9 October 2026)
- ICO, Copyright and re-use of materials: https://ico.org.uk/global/copyright-and-re-use-of-materials/ (checked 9 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.