GDPR Cyber Security: What Businesses Need to Know

GDPR cyber security is one of the most misunderstood aspects of the regulation. Many businesses treat the GDPR as a privacy law and overlook the fact that it imposes concrete cyber security obligations on every organization that processes personal data of EU residents. Getting privacy notices right means nothing if a breach exposes the data those notices describe.

This guide breaks down exactly what the GDPR requires from a cyber security perspective, the specific measures you should implement, and how to handle things when they go wrong. This content is educational and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.

What GDPR Cyber Security Actually Requires

The GDPR addresses cyber security primarily through Article 32, titled "Security of processing." This article requires data controllers and processors to implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk."

The regulation explicitly mentions four categories of measures:

• Pseudonymisation and encryption of personal data
• The ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems
• The ability to restore access to personal data in a timely manner after a physical or technical incident
• A process for regularly testing and evaluating the effectiveness of security measures

What makes Article 32 unusual compared to older regulations is its risk-based approach. The GDPR does not hand you a checklist of specific technologies. Instead, it requires you to assess the risks your processing activities create and implement measures proportional to those risks. A healthcare provider processing sensitive medical records needs stronger security controls than a blog collecting email addresses for a newsletter.

How GDPR and Cyber Security Work Together

Understanding what GDPR in cyber security means requires recognizing that the regulation treats security as a foundational requirement for all other data protection principles. Without adequate security, you cannot deliver on any of the GDPR's promises.

Security supports every GDPR principle

The GDPR's core principles in Article 5 all depend on security:

1. Lawfulness and transparency require that data is processed as described to users, which means preventing unauthorized access that could lead to misuse
2. Purpose limitation requires that data is only used for specified purposes, which means access controls that prevent unauthorized internal use
3. Data minimization limits the blast radius of any security incident by reducing the volume of data at risk
4. Accuracy requires that data is not corrupted or tampered with, which is an integrity concern
5. Storage limitation requires secure deletion processes
6. Integrity and confidentiality (Article 5(1)(f)) is explicitly a security principle

Accountability means proving your security

Article 5(2) introduces the accountability principle: you must be able to demonstrate compliance. For cyber security, this means maintaining documentation of your security measures, risk assessments, and testing results. If a supervisory authority asks how you protect personal data, "we have a firewall" is not an adequate answer. You need evidence of a systematic approach.

Technical Measures for GDPR Cyber Security Compliance

While the GDPR avoids prescribing specific technologies, enforcement actions and regulatory guidance have established clear expectations for what "appropriate" security looks like in practice.

Encryption

Encryption is one of only two technologies the GDPR mentions by name. At minimum, implement:

• Transport encryption (TLS/HTTPS) for all data in transit
• Storage encryption for personal data at rest, particularly on portable devices and in cloud storage
• Email encryption when transmitting sensitive personal data

Encryption also provides a practical benefit under Article 34: if a breach involves encrypted data that the attacker cannot decrypt, you may not need to notify affected individuals.

Access controls

Restrict who can access personal data to those who genuinely need it:

• Role-based access control with the principle of least privilege
• Multi-factor authentication for administrative accounts and remote access
• Regular access reviews to remove permissions when roles change
• Logging of access to personal data for audit purposes

Network security

Protect the infrastructure that stores and transmits personal data:

• Firewall configuration and monitoring
• Intrusion detection and prevention systems
• Network segmentation to isolate systems processing personal data
• Regular vulnerability scanning and penetration testing

Endpoint protection

Every device that accesses personal data is a potential entry point:

• Antivirus and anti-malware solutions kept current
• Operating system and application patching on a defined schedule
• Mobile device management for company and personal devices accessing data
• Secure configuration baselines for all endpoints

Your privacy policy generator should reflect the security measures you actually implement, so users understand how their data is protected.

Organisational Measures the GDPR Expects

Technical controls are only half the equation. The GDPR explicitly requires "organisational measures" alongside technical ones. These are the policies, processes, and human factors that shape your security posture.

Staff training

Human error remains the leading cause of data breaches. Article 39(1)(b) tasks the Data Protection Officer (if appointed) with raising awareness and training staff. Even without a DPO, training is an expected organisational measure. Cover these areas:

• Recognizing phishing and social engineering attempts
• Proper handling of personal data in daily operations
• Password hygiene and authentication practices
• Reporting suspected incidents immediately

Data Protection Impact Assessments

Article 35 requires a Data Protection Impact Assessment (DPIA) when processing is "likely to result in a high risk to the rights and freedoms of natural persons." DPIAs must include:

• A systematic description of the processing and its purposes
• An assessment of necessity and proportionality
• An assessment of risks to data subjects
• The measures planned to address those risks

Vendor management

Article 28 requires that you only use processors who "provide sufficient guarantees" of appropriate security. In practice, this means:

• Conducting security assessments of third-party vendors before engaging them
• Including specific security requirements in data processing agreements
• Monitoring vendor compliance on an ongoing basis
• Maintaining a register of all processors and sub-processors

GDPR Breach Notification and Cyber Security Incidents

When cyber security measures fail, the GDPR has specific requirements for what happens next. Articles 33 and 34 establish a breach notification framework that is among the strictest in the world.

The 72-hour notification window

Under Article 33, when you become aware of a personal data breach, you must notify your supervisory authority within 72 hours unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons." The notification must include:

• The nature of the breach, including approximate number of data subjects and records affected
• The name and contact details of your Data Protection Officer or other contact point
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

If you cannot provide all information within 72 hours, Article 33(4) allows you to provide it in phases, but the initial notification must still go out on time.

When to notify data subjects

Article 34 requires you to notify affected individuals directly when a breach is "likely to result in a high risk to the rights and freedoms of natural persons." This notification must describe the breach in clear, plain language and include the same categories of information provided to the supervisory authority.

Three exceptions can relieve you of the obligation to notify individuals:

1. You applied encryption or other measures that render the data unintelligible to unauthorized persons
2. You took subsequent measures that ensure the high risk is no longer likely to materialize
3. Individual notification would involve disproportionate effort, in which case a public communication is acceptable

Building an incident response plan

Having a documented incident response plan is not technically required by the GDPR's text, but it is practically essential for meeting the 72-hour deadline. Your plan should define:

• How incidents are detected and escalated
• Who has authority to declare a breach and initiate notification
• Pre-drafted notification templates for both supervisory authorities and data subjects
• Communication channels that work even if primary systems are compromised
• Post-incident review procedures to prevent recurrence

GDPR Cyber Security Penalties and Enforcement

The GDPR's penalty structure gives cyber security failures real financial consequences. Violations of Article 32 (security of processing) fall under the higher tier of fines: up to 20 million EUR or 4% of annual global turnover, whichever is greater.

Notable enforcement examples

Supervisory authorities across Europe have issued significant fines for inadequate security measures:

• British Airways received a 20 million GBP fine from the UK ICO after attackers compromised customer payment data through a vulnerability in their website
• Marriott International was fined 18.4 million GBP after a breach exposed the personal data of approximately 339 million guest records
• Advanced Computer Software Group received a 3.07 million GBP fine after a ransomware attack compromised NHS patient data due to insufficient multi-factor authentication

These cases establish a clear pattern: regulators expect proactive security investment, not reactive cleanup after incidents.

What regulators look for

When assessing penalties, Article 83 lists factors supervisory authorities consider:

• The nature, gravity, and duration of the infringement
• Whether the breach was caused by negligence or was intentional
• Actions taken to mitigate damage
• The degree of cooperation with the supervisory authority
• Previous infringements
• Categories of personal data affected

Demonstrating that you had reasonable security measures in place, even if a breach occurred, can significantly reduce penalties. A compliance scanning tool like TermsBox can help you identify gaps in your website's data collection practices, making it easier to align your security measures with the data you actually process.

How to Audit Your GDPR Cyber Security Posture

Conducting a regular security audit against GDPR requirements helps you identify gaps before a regulator or attacker does. Follow this structured approach.

Step 1: Map your data processing activities

Before you can secure personal data, you need to know where it lives. Document:

• What personal data you collect and from whom
• Where it is stored (databases, cloud services, local devices, backups)
• Who has access to it (internal staff, processors, sub-processors)
• How it flows between systems and across borders

Step 2: Assess risks to each processing activity

For each category of processing, evaluate:

• What threats could compromise the data (external attack, insider threat, accidental loss)
• How likely each threat is given your current controls
• What the impact would be on data subjects if the threat materialized

Step 3: Evaluate your current controls

Compare your existing security measures against the risks identified. Look for gaps in:

• Technical controls (encryption, access management, network security)
• Organisational controls (policies, training, vendor management)
• Detection capabilities (monitoring, logging, alerting)
• Response capabilities (incident response plan, backup and recovery)

Step 4: Implement improvements and document everything

Address the highest-risk gaps first. For each improvement, document what was implemented, when, and why. This documentation serves double duty: it guides your security team and satisfies the GDPR's accountability requirement under Article 5(2).

A privacy policy generator can help you translate your security practices into clear disclosures that meet the transparency requirements of Articles 13 and 14.

GDPR Cyber Security and International Data Transfers

When personal data crosses borders, the cyber security requirements of the GDPR follow it. Chapter V of the regulation restricts transfers of personal data to countries outside the European Economic Area unless adequate protections are in place.

Standard Contractual Clauses

Standard Contractual Clauses (SCCs) are the most common mechanism for international transfers. The European Commission's 2021 SCCs include specific security requirements that the data importer must implement, including encryption, access controls, and breach notification obligations that mirror Articles 32 through 34.

Transfer Impact Assessments

Following the Schrems II ruling (Case C-311/18), organizations must conduct Transfer Impact Assessments to evaluate whether the destination country's legal framework could undermine the protections in the SCCs. This assessment must consider:

• Whether local law enforcement or intelligence agencies can compel the data importer to disclose personal data
• Whether the data importer has any practical means to resist such demands
• What supplementary security measures (such as encryption where the importer does not hold the decryption key) could address identified risks

Adequacy decisions

Transfers to countries with an EU adequacy decision (such as the current EU-US Data Privacy Framework) do not require SCCs, but you still must implement the same Article 32 security measures for the data itself.

Building a GDPR Cyber Security Roadmap

Moving from ad hoc security to GDPR-aligned cyber security is a process, not a one-time project. A practical roadmap breaks the work into manageable phases.

Phase 1 (Months 1 to 3): Foundation

• Complete data mapping and processing inventory
• Implement encryption for data in transit and at rest
• Deploy multi-factor authentication for all administrative access
• Draft and distribute initial security policies

Phase 2 (Months 3 to 6): Hardening

• Conduct vulnerability assessments and address critical findings
• Implement network segmentation for systems processing personal data
• Establish logging and monitoring for data access
• Complete DPIAs for high-risk processing activities

Phase 3 (Months 6 to 12): Maturity

• Conduct penetration testing
• Run tabletop exercises for incident response
• Implement automated compliance monitoring
• Train all staff on data protection and security awareness

Phase 4 (Ongoing): Continuous improvement

• Quarterly vulnerability scans
• Annual penetration testing
• Regular policy reviews and updates
• Ongoing training refreshers

Frequently Asked Questions

What is GDPR in cyber security?

GDPR in cyber security refers to the data protection obligations the General Data Protection Regulation places on organizations that process personal data. Article 32 requires "appropriate technical and organisational measures" to protect data, including encryption, access controls, resilience testing, and incident response capabilities. Failure to meet these requirements can result in fines up to 20 million EUR or 4% of annual global turnover.

Does the GDPR require specific cyber security technologies?

The GDPR does not mandate specific technologies. Instead, Article 32 uses a risk-based approach, requiring measures "appropriate to the risk" based on the state of the art, implementation costs, and the nature of the data. However, the regulation explicitly mentions encryption and pseudonymisation as examples of appropriate measures.

What happens if a cyber security breach exposes personal data under the GDPR?

Under Article 33, you must notify your supervisory authority within 72 hours of becoming aware of a personal data breach. If the breach poses a high risk to individuals, Article 34 requires you to notify those individuals directly without undue delay. Failure to report breaches is itself a GDPR violation subject to fines.

Do small businesses need GDPR cyber security measures?

Yes. The GDPR applies based on what data you process and whose data you handle, not your business size. If you process personal data of EU residents, you must implement appropriate security measures regardless of whether you have five employees or five thousand. The expected level of security scales with the risk your processing poses.