Security Safeguards
This domain tests whether you can select and justify technical and organisational measures proportionate to risk, and explain how security supports privacy obligations. Expect questions on Article 32, encryption, access control and the security-privacy boundary.
Core rules
- GDPR Article 32 requires appropriate technical and organisational measures, taking into account state of the art, costs, and the nature, scope, context and purposes of processing, plus risks to individuals. Measures must ensure confidentiality, integrity, availability and resilience, restore availability after incidents, and include regular testing.
- Named measures: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; a process for testing and evaluating effectiveness.
- Article 25: data protection by design and by default - minimise collection, limit access, set retention defaults.
- Common controls: least privilege and role-based access, MFA, logging and monitoring, encryption in transit and at rest with key management, secure development and patching, vulnerability management, backups and restore testing, endpoint protection, physical security, personnel training.
- Standards: ISO/IEC 27001 (ISMS and Annex A controls), NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), SOC 2 for assurance reporting.
- Security is not only confidentiality: availability and integrity are part of the legal standard.
Worked example
A payroll provider suffers ransomware that encrypts a file server. Backups are intact, so availability is restored within hours. The team argues no breach notification is needed "because no data left the building." That is wrong: destruction of or loss of access to data is an availability breach under GDPR Article 4(12). Assess likelihood of risk (payroll data, downtime duration, backup integrity), notify the supervisory authority within 72 hours if the threshold is met, and document the reasoning either way.
Traps that cost marks
- Equating "no exfiltration" with "no breach."
- Assuming encryption eliminates all obligations; it may reduce risk, but only with proper key management.
- Choosing controls without a documented risk rationale; Article 32 is risk-based, not a fixed checklist.
- Forgetting organisational measures - training, policies, access reviews - in favour of technology alone.
- Ignoring availability and resilience in the security design.