{"id":73420,"date":"2026-08-05T22:34:47","date_gmt":"2026-08-05T20:34:47","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73420"},"modified":"2026-08-05T22:34:47","modified_gmt":"2026-08-05T20:34:47","slug":"technische-organisatorische-massnahmen","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/datenschutz-informationsschutz\/technische-organisatorische-massnahmen\/","title":{"rendered":"Technical and organisational measures"},"content":{"rendered":"
\"Datenschutz<\/span>

\u2190 Data protection & information protection<\/a><\/p>

Technical and organisational measures<\/h1>

Select TOMs based on risk, implement them in a comprehensible manner and keep them effective in operations.<\/strong><\/p><\/div><\/div>\n\n\n\n

Technical and organisational measures (TOMs) according to Art. 32 GDPR are not determined as a rigid checklist. Controllers and processors select them based on the risk to data subjects, the state of the art, implementation costs and the type, scope, circumstances and purposes of the processing. Clear responsibilities, documented decisions, technical implementation and regular effectiveness testing are crucial.<\/p>\n<\/div>\n\n\n

Relationship to services and technologies<\/h2>\n\n
\"Datenschutz<\/figure>
\n

TOMs describe risk-related controls and their verifiability; they are not a blanket security product or a promise of conformity.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Background<\/h2>\n\n

Many companies already have security controls in place, but can only incompletely demonstrate their relationship to individual processing operations, risks and responsibilities. Access grows historically, configurations change and evidence lies in tickets, policies or individual teams. A list of measures alone therefore does not answer whether it is appropriate or whether it is actually being implemented.<\/p>\n\n\n\n

TOMs connect data protection, information security, specialist processes and IT operations. They are not a one-off project task: new applications, data flows, authorisations, security events and changed risks must flow back into the control system.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n
\"Abstrakte<\/figure>
\n

Art. 32 GDPR requires appropriate measures, taking into account the state of the art and other contextual factors, to ensure a level of protection appropriate to the risk. The standard mentions, among other things, pseudonymization and encryption, confidentiality, integrity, availability and resilience of systems, recoverability and procedures for regular review, assessment and evaluation of effectiveness.<\/p>\n<\/div><\/div>\n\n\n\n

The context goes further: the accountability according to Art. 5 Para. 2 and the responsibility according to Art. 24 GDPR require being able to provide evidence of the measures and decisions taken. Art. 25 GDPR requires data protection to be taken into account through technology design and data protection-friendly default settings when determining means and processing.<\/p>\n\n\n\n

Which measure is necessary or appropriate cannot be generally determined from a product name. The starting point is processing, data types, protection needs, threats, possible consequences for those affected and existing controls. The legal assessment of processing operations remains the responsibility of the responsible data protection and legal functions.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n