TOM (Technical and Organizational Measures)

Security measures under Art. 32 GDPR — mandatory for every controller

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

Technical and Organizational Measures (TOM) pursuant to Art. 32 GDPR are mandatory security safeguards — aligned with the risk profile and the state of the art. Typical categories: pseudonymisation, encryption, confidentiality, integrity, availability, resilience, restoration capability, regular testing of effectiveness.

What are TOM (Technical and Organizational Measures)?

Art. 32 GDPR requires TOMs appropriate to the risk. Unlike ISO 27001, the GDPR does not name a specific minimum list. The state of the art is tracked continuously — BSI IT-Grundschutz, ENISA recommendations, ISO 27002.

Examples: full-disk encryption, MFA, backup strategy, patch management, authorisation concept, training, destruction of data media in accordance with DIN 66399.

Practical example

A mechanical engineering company with 30 staff documents 14 typical TOMs in a list:

MFA for all admin accounts
VPN for remote access
Full-disk encryption (BitLocker)
Daily backup with 30-day retention
Authorisation concept on a need-to-know basis
Mandatory training every year
Patch management process
Four-eyes principle for sub-contracting
Locked server room + access log
SSL/TLS for all web services
Pseudonymisation in the test environment
File destruction compliant with DIN 66399
Penetration test every year
Emergency plan + tabletop exercise every six months

Frequently asked questions

Is an ISO 27001 certification sufficient as evidence of TOMs?

As a basis yes, as sole evidence no: an ISO 27001 ISMS structurally covers many of the TOM requirements of Art. 32 GDPR, but does not replace your own assessment under Art. 32. Gaps: specific employee data protection topics (in Germany § 26 BDSG — this provision applies in Germany only; on the position in Austria see the section 'Legal position: Germany and Austria'), pseudonymisation.

How often should TOMs be updated?

Art. 32(1)(d) GDPR requires a process for regularly testing, assessing and evaluating the effectiveness of the TOMs, but sets no fixed interval. Practice rhythm (not a statutory deadline): at least annually and on material changes (new IT systems, new processing operations, new threats). Document the review cycle.

Do TOMs have to be passed on to processors?

No, but the processor must demonstrate its own TOMs (Art. 28(3)(c)). The controller assesses whether they are appropriate.

Legal position: Germany and Austria

Art. 32 GDPR is an EU regulation and applies in identical wording in Germany and Austria: the duty to implement TOMs appropriate to the risk and the categories named (pseudonymisation, encryption, confidentiality, integrity, availability, resilience, restoration capability, regular testing of effectiveness) are the same in both countries. A difference arises only in the adjacent area of employee data protection (Beschäftigtendatenschutz), which the GDPR leaves to national law through the opening clause in Art. 88 GDPR.

Germany: The processing of employee data is governed, in addition to the GDPR, by § 26 of the German Federal Data Protection Act (BDSG). This provision is German special law and applies in Germany only.

Austria: There is no § 26 BDSG. Employee data protection rests on Art. 88 and Art. 9(2)(b) GDPR in conjunction with § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG) (regulation by works agreement) and the Austrian Data Protection Act (DSG). The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB).