In short. GDPR Article 32 requires technical and organisational measures appropriate to personal data risks, including restoration capabilities and regular evaluation.
Definition: Article 32 of the General Data Protection Regulation (GDPR) requires security measures appropriate to the risks of processing personal data, meaning information relating to an identified or identifiable person. For a website, this covers protection against unauthorised access, data loss and alteration, together with restoration capabilities and regular evaluation of safeguards.
Key facts
- GDPR Article 32(1) requires consideration of the state of the art, implementation costs, processing context and risks to individuals when selecting security measures.
- As of October 2026, the European Data Protection Board's (EDPB) small business guidance recommends assessing both the severity and likelihood of risks, then implementing and monitoring appropriate measures.
- CNIL, the French data protection authority, recommends restricting website administration interfaces to authorised personnel in its security guide, version 2024.
Who is responsible for website security?
Under GDPR Article 4(7) and (8), a controller determines the purposes and means of processing personal data; a processor handles those data on the controller's behalf. Article 32(1) places the security obligation on both roles.
Article 32(2) requires attention to accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. Article 32(4) also requires steps to ensure that people with access process data only on the controller's instructions, subject to legal requirements.
The EDPB guidance translates organisational security into staff training, confidentiality clauses and an internal policy describing data protection and safety rules. Its checklist includes removing obsolete access permissions and regularly reviewing authorisations.
Which technical measures does this involve?
Article 32(1)(a) to (c) lists pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, and timely restoration after a physical or technical incident, as appropriate. Pseudonymisation means keeping the additional information needed to attribute data to a person separately, with safeguards, under Article 4(5).
For websites, CNIL's guide recommends Transport Layer Security (TLS), a protocol providing encryption and authentication, on authentication pages and pages displaying or transmitting personal data. It also recommends monitoring and updating website components, and avoiding personal data in URLs.
These are practical recommendations from the authority. The legal selection criterion remains the level of security appropriate to the processing risks under Article 32(1).
How should security measures be tested?
Article 32(1)(d) specifies a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.
CNIL's website factsheet recommends vulnerability detection tools for the most critical processing, with tests regularly and before a new software version enters production. Its backup factsheet recommends regularly testing backup integrity and the ability to restore data, keeping an offline backup and storing a backup at a geographically separate site.
The EDPB guide recommends periodic security audits. Each audit should produce an action plan whose implementation is monitored at the highest organisational level.
Related terms
- Data protection impact assessment
- GDPR data minimisation
- When must a website owner report a personal data breach?
FAQ
Does Article 32 set a fixed testing interval?
Article 32(1)(d) requires regular evaluation without specifying a calendar interval. The same article ties the appropriate security level to the risks and processing context.
Does a small website need organisational measures too?
The EDPB's small business guide covers technical and organisational measures adapted to the processing context. Its recommendations include staff awareness, an internal policy and access authorisation reviews.
Is creating backups enough to demonstrate restoration capability?
CNIL recommends testing backup integrity and the ability to restore data regularly. Article 32(1)(c) requires the ability to restore availability and access to personal data in a timely manner after an incident.
Sources
- European Parliament and Council, "General Data Protection Regulation", 27 April 2016
- European Data Protection Board, "Secure personal data", undated
- CNIL, "Practice guide GDPR: Security of personal data", version 2024
Check how a page reads to answer engines. Open the GEO score analyzer