Art. 32 GDPR · Chapter IV: Controller and processor · Section 2: Security of personal data
Article 32 GDPR: Security of processing
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
Official text
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
the pseudonymisation and encryption of personal data;
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.
Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.
The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL
Judgment of 2 December 2025ECLI:EU:C:2025:935
An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.
- C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH
Judgment of 25 January 2024ECLI:EU:C:2024:72
Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage.
- C-340/21, VB v Natsionalna agentsia za prihodite
Judgment of 14 December 2023ECLI:EU:C:2023:986
A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.
EDPB guidance
- Guidelines 01/2025 on pseudonymisation
EDPB 01/2025Draft for consultationFirst published 17 January 2025
Consultation closed 14 March 2025; final version not yet published.
Fines
Amounts are shown in the currency in which the fine was imposed.
- FRANCE TRAVAIL: EUR 5,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 22 January 2026Appeal status: unknown
Public employment service: weak authentication, poor logging and over-broad access rights let attackers using social engineering reach data on everyone registered over 20 years.
- FREE MOBILE: EUR 27,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 8 January 2026Appeal status: unknown
After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data.
- McDonald’s Polska Sp. z o.o.: PLN 16,932,657
Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), PolandAnnounced on 21 July 2025Appeal status: unknown
Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory.
Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles.
- Vodafone GmbH: EUR 45,000,000
Federal Commissioner for Data Protection and Freedom of Information (BfDI), GermanyDecision of 10 March 2025Appeal status: unknown
Two fines: EUR 15 million for poor supervision and auditing of partner shops acting as processors (staff misused customer data for fraud) and EUR 30 million for weak authentication in the online portal and hotline that allowed eSIM misuse.
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- Meta Platforms Ireland Limited: EUR 91,000,000
Data Protection Commission (Ireland), IrelandDecision of 26 September 2024Appeal status: under appeal
Stored some Facebook users' passwords in plain text, notified the breach late and did not document it.
- Apoteket AB: SEK 37,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 29 August 2024Appeal status: unknown
A pharmacy's Meta pixel sent sensitive purchase data (for example, self-tests and treatments) to Meta for over two years because of weak security routines.
- Enel Energia S.p.A.: EUR 79,107,101
Garante per la protezione dei dati personali, ItalyDecision of 8 February 2024Appeal status: upheld
Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts.
- Amazon France Logistique: EUR 32,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 27 December 2023Appeal status: reduced
Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 7 April 2022Appeal status: unknown
Kept an unlawful fraud blacklist (FSV) on about 270,000 people for over six years: no legal basis, inaccurate data, weak security, DPO not involved in the DPIA.
- IAB Europe: EUR 250,000
Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), BelgiumDecision of 2 February 2022Appeal status: upheld
The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.
- Deliveroo Italy s.r.l.: EUR 2,500,000
Garante per la protezione dei dati personali, ItalyDecision of 22 July 2021Appeal status: unknown
Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.
- Marriott International Inc: GBP 18,400,000
Information Commissioner's Office (United Kingdom), United KingdomDecision of 30 October 2020Appeal status: unknown
Starwood's systems, compromised in 2014 and later acquired by Marriott, were not detected as breached until September 2018; security of guest data was inadequate.
- British Airways plc: GBP 20,000,000
Information Commissioner's Office (United Kingdom), United KingdomDecision of 16 October 2020Appeal status: unknown
An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018).
- 1&1 Telecom GmbH: EUR 9,550,000
Federal Commissioner for Data Protection and Freedom of Information (BfDI), GermanyAnnounced on 9 December 2019Appeal status: reduced
Telecom call centre released extensive customer data to anyone who could give a customer's name and date of birth; inadequate authentication.
- Knuddels: EUR 20,000
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), GermanyDecision of 21 November 2018Appeal status: unknown
First German GDPR fine: a chat platform stored users' passwords in plain text, exposed in a hack of about 330,000 accounts; low amount reflects exemplary cooperation.