Technical and organisational measures (TOM)

• TOM help to ensure the security of personal data.
• According to the General Data Protection Regulation (GDPR), there is a documentation obligation for TOM
• The implementation of appropriate TOM is a legal requirement
• A GDPR risk analysis forms the basis for the selection of adequate TOMs
• In case of inadequate TOM, fines can be imposed
• When selecting contractors, it is important to ensure that they can demonstrate adequate TOM

Technical and organisational measures (TOM) form the iron bulwark of data protection. They are divided into technical measures, which act like indispensable high-tech armour and erect an impenetrable protective shield with encryption, firewall systems, and access controls. And organisational measures, which, on the other hand, are the skilled masterminds that coordinate data protection practices in line with legal requirements. These include policies, procedures, and training that turn employees into vigilant guardians of data protection. Together, these measures form the invisible web that strengthens people's trust in the digital world and gives them the assurance that their data is in good hands.

The GDPR sets higher requirements for security in processing personal data and entails extensive documentation and verification obligations for companies and data protection officers. All measures taken must be documented in order to have proof of the precautions taken in the event of a loss. 
 

If TOM is inadequately implemented, resulting in a breach of data protection rules, this can lead to fines.      
Under the GDPR, fines of up to €20 million or 4% of the global annual turnover of the company concerned, whichever is higher, can be imposed. These fines are set by the competent data protection authorities and may vary depending on the nature and severity of the breach.       
It is important to note that data protection authorities do not automatically impose fines when a breach is detected. They may first take other measures, such as asking you to rectify the breaches, issuing warnings or ordering provisional or definitive measures.      

Tip: Do you also work with external service providers? Then you should always have their technical and organisational measures pointed out to you and confirmed in writing!      
Implementing technical and organisational measures not only promotes data protection, but also creates added value for companies:

• Sensitive company data is consistently and better protected
• The efficiency of company processes is demonstrated
• The data stock takes on a new meaning worthy of protection
• The existing IT is evaluated and improved if necessary. This can increase added value
• Employees are involved in the processes and feel more valued

• Data encryption: One of the most effective measures to protect personal data is encryption. All data that is transmitted or stored should be encrypted.
• Firewall: Make sure your systems and networks are protected by a firewall. A firewall can restrict access to your data from the outside.
• Access control: It is important that only authorised people can access data. It is best to use strong passwords and two-factor authentication.
• Data backup: Regular backups ensure that data can be restored in the event of data loss. Review the backup strategy regularly and make sure that data is stored securely.
• Patches and updates: Keep your systems and software up to date by installing regular patches and updates. This will close known security gaps.
• Virus protection: Install up-to-date virus protection on all end devices and update it regularly.

• Datenschutzschulungen für die Mitarbeiter: Diese Schulungen helfen, die Bedeutung des Datenschutzes zu verstehen und die TOM korrekt anzuwenden.
• In- und externe Geheimhaltung: Eine Geheimhaltung schützt vor unautorisierten Zugriffen auf personenbezogene Daten.
• Besucherregistrierung: Eine Besucherregistrierung hilft, den Zugang zu sensiblen Bereichen zu kontrollieren.
• Datenschutzbeauftragter, intern oder extern: Der Datenschutzbeauftragte muss durch Beratung und Überwachung einen wirksamen Schutz personenbezogener Daten gewährleisten.

Do you want to ensure that the technical and organisational measures (TOM) are implemented smoothly? Rely on heyData, our innovative platform, and our team of experienced lawyers to help you.      
As an external data protection officer, we are at your side and take the burden of TOM implementation off your shoulders. You can focus on your day-to-day business while we ensure appropriate safeguards are in place.      
We work closely with your team to coordinate and monitor compliance with the GDPR. Together, we assess your IT landscape and review your current state to ensure your business is compliant.

Through certified training and consulting, we ensure that your employees are informed about the latest best practices. Your processes are reviewed and the appropriate measures are proposed and implemented.

Take advantage of our expert knowledge and rely on the expertise of heyData.