---
title: "Art. 32 GDPR: Security of processing"
canonical: "https://dposchool.com/gdpr/article/32"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_32"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 32 GDPR · Chapter IV: Controller and processor · Section 2: Security of personal data

# Article 32 GDPR: Security of processing

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

The controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

## Official text

### Article 32(1)

**1.** Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

#### Article 32(1)(a)

**(a)** the pseudonymisation and encryption of personal data;

#### Article 32(1)(b)

**(b)** the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

#### Article 32(1)(c)

**(c)** the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

#### Article 32(1)(d)

**(d)** a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

### Article 32(2)

**2.** In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

### Article 32(3)

**3.** Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.

### Article 32(4)

**4.** The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 32 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_32)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 83](https://dposchool.com/gdpr/recital/83)

## Court of Justice judgments

### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23)

Judgment of 2 December 2025 · ECLI:EU:C:2025:935

An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492)

### [C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21)

Judgment of 25 January 2024 · ECLI:EU:C:2024:72

Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687)

### [C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21)

Judgment of 14 December 2023 · ECLI:EU:C:2023:986

A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340)

## EDPB guidance

### [Guidelines 01/2025 on pseudonymisation](https://dposchool.com/gdpr/guidance/edpb-01-2025)

EDPB 01/2025 · Draft for consultation · First published 17 January 2025

Consultation closed 14 March 2025; final version not yet published.

[Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012025-on-pseudonymisation_en)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [FRANCE TRAVAIL: EUR 5,000,000](https://dposchool.com/gdpr/fine/cnil-france-travail-2026-01)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 22 January 2026 · Appeal status: unknown

Public employment service: weak authentication, poor logging and over-broad access rights let attackers using social engineering reach data on everyone registered over 20 years.

[Source: the authority](https://www.edpb.europa.eu/news/data-breach-france-travail-fined-eur-5-000-000_en)

### [FREE MOBILE: EUR 27,000,000](https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 8 January 2026 · Appeal status: unknown

After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data.

[Source: the authority](https://www.cnil.fr/en/sanction-free-2026)

### [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07)

Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), Poland · Announced on 21 July 2025 · Appeal status: unknown

Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory.

Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles.

[Source: the authority](https://uodo.gov.pl/pl/138/3827)

### [Vodafone GmbH: EUR 45,000,000](https://dposchool.com/gdpr/fine/bfdi-vodafone-2025-03)

Federal Commissioner for Data Protection and Freedom of Information (BfDI), Germany · Decision of 10 March 2025 · Appeal status: unknown

Two fines: EUR 15 million for poor supervision and auditing of partner shops acting as processors (staff misused customer data for fraud) and EUR 30 million for weak authentication in the online portal and hotline that allowed eSIM misuse.

[Source: the authority](https://www.edpb.europa.eu/news/german-federal-sa-administrative-fines-in-the-amount-of-eu15-000-000-and-eu30-000-000-as-well_en)

### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11)

Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

### [Meta Platforms Ireland Limited: EUR 91,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-09)

Data Protection Commission (Ireland), Ireland · Decision of 26 September 2024 · Appeal status: under appeal

Stored some Facebook users' passwords in plain text, notified the breach late and did not document it.

[Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-september-2024)

### [Apoteket AB: SEK 37,000,000](https://dposchool.com/gdpr/fine/imy-apoteket-2024-08)

Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 29 August 2024 · Appeal status: unknown

A pharmacy's Meta pixel sent sensitive purchase data (for example, self-tests and treatments) to Meta for over two years because of weak security routines.

[Source: the authority](https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/)

### [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02)

Garante per la protezione dei dati personali, Italy · Decision of 8 February 2024 · Appeal status: upheld

Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710)

### [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 27 December 2023 · Appeal status: reduced

Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272)

### [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10)

Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Croatia · Announced on 5 October 2023 · Appeal status: unknown

Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.

[Source: the authority](https://azop.hr/agenciji-za-naplatu-potrazivanja-eos-matrix-d-o-o-izrecena-upravna-novcana-kazna-u-iznosu-od-547-milijuna-eura/)

### [Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000](https://dposchool.com/gdpr/fine/ap-belastingdienst-2022-04)

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 7 April 2022 · Appeal status: unknown

Kept an unlawful fraud blacklist (FSV) on about 270,000 people for over six years: no legal basis, inaccurate data, weak security, DPO not involved in the DPIA.

[Source: the authority](https://autoriteitpersoonsgegevens.nl/actueel/boete-belastingdienst-voor-zwarte-lijst-fsv)

### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02)

Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld

The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.

[Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr)

### [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07)

Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown

Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records.

[Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994)

### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown

Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.

Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756)

### [Marriott International Inc: GBP 18,400,000](https://dposchool.com/gdpr/fine/ico-marriott-2020-10)

Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 30 October 2020 · Appeal status: unknown

Starwood's systems, compromised in 2014 and later acquired by Marriott, were not detected as breached until September 2018; security of guest data was inadequate.

[Source: the authority](https://ico.org.uk/media2/migrated/2618524/marriott-international-inc-mpn-20201030.pdf)

### [British Airways plc: GBP 20,000,000](https://dposchool.com/gdpr/fine/ico-ba-2020-10)

Information Commissioner's Office (United Kingdom), United Kingdom · Decision of 16 October 2020 · Appeal status: unknown

An attacker used compromised remote-access credentials and altered a script on the airline's website to send customers' card data to an outside domain (22 June to 5 September 2018).

[Source: the authority](https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf)

### [1&1 Telecom GmbH: EUR 9,550,000](https://dposchool.com/gdpr/fine/bfdi-1und1-2019-12)

Federal Commissioner for Data Protection and Freedom of Information (BfDI), Germany · Announced on 9 December 2019 · Appeal status: reduced

Telecom call centre released extensive customer data to anyone who could give a customer's name and date of birth; inadequate authentication.

[Source: the authority](https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2019/30_BfDIverh%C3%A4ngtGeldbu%C3%9Fe1u1.html)

### [Knuddels: EUR 20,000](https://dposchool.com/gdpr/fine/lfdi-bw-knuddels-2018-11)

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Germany · Decision of 21 November 2018 · Appeal status: unknown

First German GDPR fine: a chat platform stored users' passwords in plain text, exposed in a hack of about 330,000 accounts; low amount reflects exemplary cooperation.

[Source: the authority](https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 32

Previous: [Art. 31 GDPR: Cooperation with the supervisory authority](https://dposchool.com/gdpr/article/31)

Next: [Art. 33 GDPR: Notification of a personal data breach to the supervisory authority](https://dposchool.com/gdpr/article/33)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents