Data security

Data security refers to the protection of data against unauthorised access, loss, alteration and destruction. It encompasses technical and organisational measures designed to ensure the confidentiality, integrity and availability of information. Where personal data is processed, the key legal requirements arise in particular from Article 32 of the General Data Protection Regulation (GDPR).

What does data security mean, and how does it differ from data protection?

Data security encompasses all measures designed to protect data and the systems used to process it against security risks. These include, in particular, cyberattacks, technical failures, human error and unauthorised access. It applies both to personal data and to other information requiring protection, such as trade secrets.

Data protection and data security pursue different but closely related objectives. While data protection safeguards the rights and freedoms of natural persons in relation to the processing of their personal data, data security focuses on protecting information and the systems used to process it.

Data security is therefore an essential component of effective data protection. Lawful processing of personal data also requires appropriate security measures. Conversely, technically secure data processing alone does not ensure compliance with all data protection requirements.

What protection objectives does data security pursue?

Data security is based in particular on three fundamental protection objectives: confidentiality, integrity and availability. These form the basis for selecting and assessing appropriate security measures.

• Confidentiality: Information may only be accessed or processed by authorised persons. Access restrictions and encryption protect against unauthorised disclosure.
• Integrity: Data must be complete and protected against unauthorised or accidental alteration. Changes should be traceable, and tampering should be detectable.
• Availability: Data and IT systems must remain accessible to authorised users to the extent required. Data backups and recovery procedures limit the consequences of technical disruptions.

Article 32(1)(b) GDPR additionally refers to the ongoing resilience of processing systems and services. Organisations must design their security measures to ensure that the processing of personal data remains adequately protected even in the event of disruptions and security incidents.

The protection objectives must be considered together. For example, a system is not adequately protected if stored data is encrypted but cannot be restored following a technical failure.

What requirements does the GDPR impose on data security?

The central provision governing data security under data protection law is Article 32 GDPR. It requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

The following factors must be taken into account when selecting the measures:

• the state of the art;
• the costs of implementation;
• the nature, scope, context and purposes of the processing;
• the likelihood and severity of potential risks to the rights and freedoms of natural persons.

The GDPR therefore does not prescribe a single security framework for all organisations. What matters is a risk-based assessment of the specific processing activities.

More extensive protective measures are required where particularly sensitive data is involved or where security risks are elevated. Smaller organisations must also ensure an appropriate level of data security; the size of an organisation alone does not exempt it from statutory requirements.

In addition, Article 5(1)(f) GDPR requires the integrity and confidentiality of personal data to be ensured. Articles 24 and 25 GDPR set out further requirements concerning responsibility for processing and data protection by design.

Which technical and organisational measures ensure data security?

Technical and organisational measures (TOMs) are intended to reduce security risks and provide appropriate protection for personal data. The measures required depend on the risk assessment in each individual case.

Typical measures include:

• Access controls: Access authorisation policies, secure passwords and multi-factor authentication protect against unauthorised access.
• Encryption: Appropriate encryption methods protect data both at rest and in transit.
• Pseudonymisation: Separating personal data from additional identifying information reduces risks to data subjects.
• Data backups: Regular backups and tested recovery procedures help maintain availability in the event of data loss or system failures.
• System protection: Security updates, firewalls and other protective mechanisms reduce technical vulnerabilities.
• Organisational arrangements: Binding security policies, clearly defined responsibilities and employee training reduce risks arising from misconduct and human error.
• Monitoring and review: Regular security audits and assessments of existing protective measures help identify and remedy vulnerabilities.

Article 32(1)(d) GDPR requires a process for regularly testing, assessing and evaluating the effectiveness of security measures.

Introducing a security framework once is therefore not sufficient. Organisations must regularly review their measures and adapt them to changing risks, technological developments and new processing activities.

What must organisations consider in the event of a data security breach?

If a security incident occurs, organisations must first investigate its impact, contain the incident and implement the necessary protective measures. These may include, for example, blocking compromised access credentials, securing affected systems and restoring lost data.

If the incident affects personal data, it must also be assessed whether a personal data breach within the meaning of Article 4(12) GDPR has occurred. Such a breach includes, in particular, the accidental or unlawful destruction, loss or alteration of personal data, or the unauthorised disclosure of or access to personal data.

Under Article 33 GDPR, the controller must notify a personal data breach that is subject to notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

If the breach is likely to result in a high risk to the rights and freedoms of data subjects, they must generally be informed under Article 34 GDPR, unless a statutory exception applies.

Under Article 33(5) GDPR, the controller must document personal data breaches. This also applies to incidents that do not need to be notified to the supervisory authority.

Practical example: Data security in an organisation

A medium-sized organisation stores the personal data of its customers and employees in a central IT system. This includes contact details, contractual documents and information relevant to billing.

To provide appropriate protection for the data, the organisation introduces a role-based access control system. Employees are granted only the access rights they need to perform their respective duties. Multi-factor authentication, encryption and regular security updates are also implemented.

The organisation creates automated data backups and uses recovery tests to verify that data can be made available again following a technical failure. Employees receive regular training on IT security risks and how to deal with suspicious emails.

Despite these measures, an attacker gains access to part of the system through a compromised user account. The organisation blocks the account, investigates the incident and determines which personal data has been affected. It then assesses its notification and communication obligations under Articles 33 and 34 GDPR and documents the personal data breach.

legal data assessment: Effective data security requires a security framework tailored to the specific risks involved. Technical safeguards must be complemented by clear organisational policies, trained employees and regular effectiveness reviews. Organisations must also establish procedures for handling security incidents so that personal data breaches can be identified at an early stage and statutory obligations can be reliably fulfilled.

Legal bases

Article 5(1)(f) GDPR; Articles 24, 25 and 32 GDPR; Articles 33 and 34 GDPR; Articles 58 and 83 GDPR.