The GDPR does not prescribe which firewall or which backup method a company must use. Instead, it requires a level of protection appropriate to the risk. According to Art. 32, factors to be taken into account include the state of the art, the costs of implementation, the nature, scope and purposes of processing, and the likelihood and severity of the risk for the persons concerned.
TOMs are the concrete answer to this requirement. They are usually documented in writing, for example as an annex to data processing agreements (DPAs) or in the record of processing activities.
How TOMs are structured
Art. 32 gives as examples pseudonymization and encryption, ensuring the ongoing confidentiality, integrity, availability and resilience of systems, rapid recovery after an incident, and procedures for regularly testing effectiveness.
Technical measures apply to systems, organizational measures to processes and behavior. In practice, TOMs are often structured by protection goals:
- Confidentiality: physical access, system access and data access control, encryption, pseudonymization, confidentiality obligations.
- Integrity: protection against unauthorized changes, logging of inputs and transfers.
- Availability and resilience: backup, protection against malware, uninterruptible power supply, emergency plans.
- Review: regular checks of effectiveness, for example through audits, tests or an ISMS.
Typical examples
- Notebooks are fully encrypted so that no one can access the data if they are lost.
- Only the HR department has access to personnel files, and access is logged.
- Employees are bound to confidentiality when they join and are trained regularly.
- Backups are stored separately, and restoration is tested regularly.
- A service provider describes in the contract annex how the data center, remote access and backup are protected.
What companies should keep in mind
- Describe TOMs as they are actually implemented, not as they should ideally look.
- Update the documentation when systems, locations or service providers change.
- For processors, check whether their measures match your own protection needs.
- Align measures with the risk: health or personnel data requires more protection than a list of company addresses.
- Review effectiveness regularly, as Art. 32 explicitly requires.
This entry is a general overview and does not replace legal advice.
View Cyber Security