What Are GDPR Technical and Organisational Measures?

Examples of GDPR Organisational Measures

Think of your GDPR organisational measures as any steps, actions or controls that you can take to comply with the data protection rules and protect personal data. The below list is not exhaustive; however, it does provide some examples of the types of GDPR measures classified as ‘organisational’.

• Information Security Policies – Scope and content will depend on the size of the organisation and type of processing activities. Smaller firms may only require a standard information security policy. However, larger or more complex businesses will need policies in specific areas such as remote access, asset management and password controls
• Business Continuity – regardless of size, all organisations should have a Business Continuity Plan. Measures for protecting personal data and upholding the GDPR principles are at the heart of any effective disaster recovery program. How is data secured, accessed, recovered and maintained the even of an incident?
• Risk Assessment – Assess high risk data and processing activities and developing mitigating solutions to prevent or reduce risks. Often a Data Protection Impact Assessment is a mandatory requirement if the processing is high risk.

• Policies and Procedures – Ensure that you have effective and compliant data protection policies and procedures in place. These should be readily available to employees as a form of guidance and support. Documenting your GDPR obligations, objectives and controls is one of the key organisational measures.
• Management Information & Reporting – Regular reporting and management information provides invaluable information. It should include data protection risks, mitigating measures and requirements to form effective technical and organisational measures. They also inform decisions on funding and resources which are vital for accountability at all levels.
• Awareness & Training – A culture of security and data protection awareness is the foundation of any business with GDPR responsibilities. Ensuring that employees, contractors and visitors understand what your data protection obligations are will help to maintain compliance. Signposting is a user-friendly way of reminding people of the GDPR obligations. Regular and ongoing training sessions inform, guide and support.
• Reviews & Audits – You may have all of the policies, controls and measures in place, but how do you know they are effective? Reviewing and auditing functions, activities and systems is mandatory for most businesses. You should be able to evidence that your policies and controls are fit for purpose. Completing a GDPR self assessment on a regular basis can help to review the key compliance areas and identify any gaps before they become a breach.
• Due Diligence – Who you form business relationships with is just as important as the steps you take to comply with the GDPR. Do you know who your employees are and what their background is? Are your suppliers as compliant with the data protection laws as you are? There is little point putting extensive security and data protection measures into place if you are going to pass data to a third-party who cannot guarantee its safety or protection.