Technical and Organizational Measures (TOMs): What They Are and Why They Matter Under GDPR

Technical and organizational measures (TOMs) are the real-world actions you take to safeguard data. They’re not just IT settings or compliance checkboxes. They’re habits your organization builds, through technology, policy, and culture, to handle data responsibly.

• Technical measures include the tools and technologies: encryption, secure servers, and multi-factor authentication.
• Organizational measures cover internal policies, staff training, access protocols, and clearly defined responsibilities.

Together, they form the foundation of your GDPR compliance strategy. And more importantly, they reduce the risk of data breaches and privacy violations.

The GDPR makes one thing clear: security measures should be proportionate to risk. That means your TOMs need to reflect how sensitive the data is, what you’re doing with it, and what could go wrong if something fails.

So yes - every company needs TOMs. But the specific mix of controls will look very different for:

• A dentist’s office handling patient records
• A SaaS company storing user credentials
• A marketing agency collecting newsletter signups

In case there's a serious data breach or violation of data protection rules, TOMs can demonstrate that proper steps were taken to protect the data. The company must document these measures early on before authorities ask for it. This documentation starts as soon as personal data is being processed, typically when data like email addresses for newsletters or general customer information is collected.

Right after data collection and documentation begin, it's important to make sure that the TOMs align with the needs of the industry. For example, a doctor's office that handles sensitive patient data, like insurance numbers and medical records, needs more robust IT infrastructure security compared to a tradesperson who stores customer data on a platform like Excel. Each situation has different expectations for data protection, and the TOMs should be tailored accordingly to meet these requirements. 

GDPR Article 32 outlines several areas where Technical and Organizational Measures should apply. Here’s how those translate into the real world:

Access Control

Make sure only the right people can access the right data.

• Use role-based permissions
• Set up secure logins with MFA
• Remove access quickly when staff leave

Transmission Control

Keep data safe when it’s being sent or received.

• Encrypt data in transit (HTTPS, SFTP)
• Use secure cloud storage or VPNs
• Don’t send personal data over unencrypted email

Input Control

Track who’s changing what and when.

• Enable detailed logging
• Require individual user accounts (no shared logins)
• Use audit trails, especially for sensitive records

Separation Control

Avoid mixing data that shouldn’t be processed together.

• Separate HR data from marketing data
• Restrict internal access based on purpose
• Clarify data usage in your records of processing

Availability Control

Ensure systems and data stay up and running—even if things go wrong.

• Back up data regularly (and test your restores)
• Create a disaster recovery plan
• Set up redundant infrastructure where needed

Pseudonymization and Encryption

Make data less useful to attackers—even if they get their hands on it.

• Encrypt files, databases, and backups
• Use pseudonymized identifiers instead of names
• Store encryption keys securely and separately

TOMs aren’t frozen in time - they evolve as your tech stack does. Let’s explore what that means in 2025.

Cloud Services

Most companies use cloud platforms, but entrusting your data to someone else does not exempt you from your GDPR responsibilities.

• Understand the shared responsibility model
• Work with providers who offer clear security commitments
• Review their certifications (ISO 27001)
• Encrypt sensitive data before uploading

AI and Automated Decision-Making

If you’re training models on personal data or using AI to profile users, TOMs matter more than ever.

• Use pseudonymized datasets during model training
• Document how decisions are made and reviewed
• Restrict access to model outputs, especially if they affect individuals’ rights

Remote and Hybrid Work

Security isn’t just about office networks anymore.

• Require VPNs for off-site access
• Encrypt laptops and mobile devices
• Provide ongoing staff training to prevent home-office data leaks
• Use mobile device management (MDM) to enforce security standards remotely