What are technical and organiza­tional measures (TOMs)?

TOMs: definition and legal basis

Art. 32 GDPR obliges controllers and processors to ensure a level of protection appropriate to the risk. To be taken into account are the state of the art, implementation costs, the nature, scope and purposes of processing, and the likelihood and severity of possible risks to data subjects. Technical measures work through systems, organizational ones through procedures and rules.

The aim is to protect the confidentiality, integrity and availability of data and the resilience of systems. The regulation names as examples pseudonymization and encryption, the ability to restore data quickly after an incident, and a process for regularly testing effectiveness. There is no fixed checklist: the selection depends on the risk in each individual case.

Typical measures at a glance

In practice, TOMs are usually structured by control areas that follow earlier statutory requirements. This structure helps ensure nothing is forgotten and also serves as an annex to contracts with service providers. Which points are relevant depends on size, industry and type of data.

• Physical access: lockable rooms, key management, visitor rules
• System and data access: user accounts, password rules, two-factor authentication, roles and rights
• Transfer: encryption in transit and at rest, secure remote maintenance
• Input: logging who changed which data and when
• Availability: backups, emergency plan, recovery tests
• Separation: keeping data of different customers and purposes apart
• Organization: training, confidentiality commitments, policies

Real-world example: a supplier with a customer portal

A supplier runs a customer portal in which retailers view orders and invoices. The data sits on a server to which all IT staff have administrator rights; backups are stored on the same machine, and passwords are subject to no rules. A customer asks about the TOMs under its data processing agreement and receives only a template text.

The improvements: a role concept with minimum rights, two-factor login for administrators, encryption, backups on a separate system with a restore test and a short emergency instruction. The measures are recorded in a TOM document that the customer can view and are reviewed regularly from now on.

Docu­menta­tion, evidence and common mistakes

TOMs must be documented in writing and kept up to date: for the record of processing activities, for data processing agreements and as evidence to supervisory authorities and customers. Certifications such as ISO 27001 can support the evidence but do not replace it automatically. What matters is that the measures actually apply and are practiced.

Typical mistakes: a template text that never fit the business, measures only on paper (such as a backup that was never tested), outdated information after system changes and unclear responsibilities. Free tools and private devices must also be considered as soon as personal data is processed with them.

What companies should look out for

Start with a risk assessment: which data is particularly sensitive, which systems particularly critical? Derive proportionate measures from it, name those responsible and review their effect regularly. Nano Concepts implements technical measures such as permission concepts, encryption, backups and monitoring, and supports the documentation. This article does not replace legal advice.