Guides to the security controls regulators expect under Article 32: risk assessment, encryption, access control and MFA, logging and monitoring, backup and restore, and pseudonymisation versus anonymisation.
A risk assessment method that satisfies Article 32: rating impact on individuals rather than the business, risk sources and threats, severity and likelihood scales, choosing measures, periodic audits, and when the result also requires a DPIA.
Whether and when the GDPR requires encryption, how encryption changes breach notification duties, why key management decides the outcome, and when encryption makes transfers or foreign hosting acceptable.
What access control the GDPR expects in practice: unique accounts, strong authentication, need-to-know profiles, periodic access reviews and leaver removal, defaults on accessibility, and a 2026 fine where remote access lacked VPN and MFA.
How logging and monitoring fit the GDPR: detection as a security measure regulators fine for lacking, the legitimate interest for network security, logs as personal data subject to access and retention rules, and detection speed versus the 72-hour clock.
What the GDPR expects of backups: timely restoration under Article 32(1)(c), availability breaches, how backups change breach outcomes in the EDPB ransomware cases, minimum backup policy, and the erasure problem in backups.
The practical difference between pseudonymised data, which stays personal data, and anonymised data, which leaves the GDPR: the legal tests, EDPB examples and guidelines, anonymisation failures in enforcement, and the test for AI models.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.