Technical and organisational measures

Context: Why TOMs matter

In an increasingly digital world, protecting personal data is of the highest importance. Technical and organisational measures (TOMs) ensure that businesses comply with the GDPR and safeguard the integrity of customer data.

TOMs include technical security measures, organisational training, and physical safeguards. These measures should be reviewed, adjusted, and optimised regularly.

What are technical and organisational measures?

Technical and organisational measures, often referred to as TOMs, form the backbone of data protection under the GDPR.

Regardless of business size, TOMs are essential to increase data security and ensure that personal data is processed in line with legal requirements.

Types of TOMs: technical measures (e.g. end-to-end encryption, firewalls, secure servers), organisational measures (e.g. training, policies, emergency plans), and physical measures (e.g. access controls, protection of paper documents).

Who needs TOMs?

Every business that processes personal data needs a solid foundation of TOMs.

TOMs are not only relevant for IT companies or sectors with sensitive data – they are central to reputation, trustworthiness, and business success.

How do I create TOMs for my business?

Practical approach: needs analysis (Which data? Where stored? Who has access?), technical safeguards (e.g. encryption), organisational structures (training, policies), and regular review and adjustment.

External experts or tools can support implementation and make the process easier.

Appropriate TOMs to protect personal data

Examples: encryption (in transit and at rest), access control (authorised persons only), physical security measures (secured premises), regular backups.

Appropriate TOMs for data collection and processing

Examples: data minimisation (only necessary data), anonymisation (e.g. in surveys), monitoring systems (detect unusual activity), regular software updates (close security gaps).

Implementation: An ongoing process

Implementing TOMs is not a one-off act. It requires risk assessment, continuous monitoring, and regular training.

Audits, penetration tests, and feedback from employees are suitable ways to verify effectiveness.

What happens if I do not have TOMs?

Without TOMs, you risk: GDPR violations, financial penalties, reputational damage, legal consequences, competitive disadvantages, higher follow-up costs after data breaches, and an increased risk of cyber attacks.

Conclusion

TOMs are not only a legal requirement but essential for trust and compliance. Proper implementation and ongoing adjustment protect against penalties and reputational loss.