Technical and organisational measures (TOM)

Technical organizational measures refer to the security policies and procedures that companies must implement to meet the requirements of the GDPR. These measures should be based on a thorough risk analysis and include both preventative and reactive elements to effectively manage potential data protection risks.

• TOM help to ensure the security of personal data.
• According to the General Data Protection Regulation (GDPR), there is a documentation obligation for TOM
• The implementation of appropriate TOM is a legal requirement
• Article 32 of the GDPR obliges companies to comply with appropriate technical (e.g. encryption) and organizational (e.g. data protection guidelines) measures.
• A GDPR risk analysis forms the basis for the selection of adequate TOMs
• In case of inadequate TOM, fines can be imposed
• When selecting contractors, it is important to ensure that they can demonstrate adequate TOM

Technical and organisational measures (TOM) form the iron bulwark of data protection. They are divided into technical measures, which act like indispensable high-tech armour and erect an impenetrable protective shield with encryption, firewall systems, and access controls. And organisational measures, which, on the other hand, are the skilled masterminds that coordinate data protection practices in line with legal requirements. These include policies, procedures, and training that turn employees into vigilant guardians of data protection. Together, these measures form the invisible web that strengthens people's trust in the digital world and gives them the assurance that their data is in good hands.

The GDPR sets higher requirements for security in processing personal data and entails extensive documentation and verification obligations for companies and data protection officers. All measures taken must be documented in order to have proof of the precautions taken in the event of a loss. 

Legal requirements: GDPR article in focus

The GDPR sets out specific requirements for the security of personal data in several articles. Article 25, for example, requires “Privacy by design and privacy by default”. Article 32, on the other hand, deals with the security of processing and contains explicit requirements for technical and organizational measures, including the pseudonymization and encryption of personal data.

If TOM is inadequately implemented, resulting in a breach of data protection rules, this can lead to fines.      
Under the GDPR, fines of up to €20 million or 4% of the global annual turnover of the company concerned, whichever is higher, can be imposed. These fines are set by the competent data protection authorities and may vary depending on the nature and severity of the breach.       
It is important to note that data protection authorities do not automatically impose fines when a breach is detected. They may first take other measures, such as asking you to rectify the breaches, issuing warnings or ordering provisional or definitive measures.      

Tip: Do you also work with external service providers? Then you should always have their technical and organisational measures pointed out to you and confirmed in writing!      
Implementing technical and organisational measures not only promotes data protection, but also creates added value for companies:

• Sensitive company data is consistently and better protected
• The efficiency of company processes is demonstrated
• The data stock takes on a new meaning worthy of protection
• The existing IT is evaluated and improved if necessary. This can increase added value
• Employees are involved in the processes and feel more valued

The correct implementation of technical and organizational measures is crucial to comply with the GDPR and avoid heavy fines. Here's your guide to getting there safely:

1. Carry out risk analysis: Identify potential risks to personal data.
2. Select measures: Decide on technical and organizational solutions that are appropriate to the identified risks.
3. Plan implementation: Create a detailed plan for the implementation of the selected measures
4. Training of employees: Ensure that all employees are informed and trained on the relevant data protection practices.
5. Monitoring and review: Schedule regular reviews of the measures to ensure their effectiveness and make adjustments.

• Data encryption: One of the most effective measures to protect personal data is encryption. All data that is transmitted or stored should be encrypted.
• Firewall: Make sure your systems and networks are protected by a firewall. A firewall can restrict access to your data from the outside.
• Access control: It is important that only authorised people can access data. It is best to use strong passwords and two-factor authentication.
• Data backup: Regular backups ensure that data can be restored in the event of data loss. Review the backup strategy regularly and make sure that data is stored securely.
• Patches and updates: Keep your systems and software up to date by installing regular patches and updates. This will close known security gaps.
• Virus protection: Install up-to-date virus protection on all end devices and update it regularly.

• Data protection training for employees: This training helps employees to understand the importance of data protection and to apply the TOM correctly.
• Internal and external confidentiality: Confidentiality protects against unauthorized access to personal data.
  Visitor registration: Visitor registration helps to control access to sensitive areas.
• Data protection officer, internal or external: The data protection officer must ensure effective protection of personal data through advice and monitoring.

Common challenges and solutions

Implementing and maintaining effective TOMs can present challenges, such as constantly adapting to new technologies or ensuring employee training. Solutions may include the involvement of external data protection officers, the use of specialized compliance software, or regular internal audits and training.

Do you want to ensure that the technical and organizational measures (TOM) are implemented smoothly? Rely on heyData, our innovative platform, and our team of experienced lawyers to help you.      
As an external data protection officer, we are at your side and take the burden of TOM implementation off your shoulders. You can focus on your day-to-day business while we ensure appropriate safeguards are in place.      
We work closely with your team to coordinate and monitor compliance with the GDPR. Together, we assess your IT landscape and review your current state to ensure your business is compliant.

Through certified training and consulting, we ensure that your employees are informed about the latest best practices. Your processes are reviewed and the appropriate measures are proposed and implemented.

Take advantage of our expert knowledge and rely on the expertise of heyData.