We generate your technical and organisational measures automatically in minutes. Create them online now and download immediately.
10,000+
Happy users
40,000+
Legal documents created
1,500+
Integrated services
Light current-state review: Dieter asks in plain language what matters technically and organisationally for you – without empty phrases.
Context & risk
Capture company, systems, and processing at a high level – the basis for appropriate measures under Art. 32 GDPR.
Dieter creates your TOM document
Technical measures (e.g. access, availability) and organisational measures (e.g. training, instructions) are documented in a structured way.
Maintain & adapt
Update TOM when tools, locations, or incidents change – your evidence stays current.
Evidence instead of gut feeling
TOM are central for Art. 32, DPAs, audits, and insurance. With Dieter you have documented protection levels instead of a spreadsheet. The full catalogue of measures with examples is in our practical guide to TOM, and how it connects to the records in the article on records of processing activities and deletion concept.
Anyone handling personal data needs technical and organisational measures (TOM) – start-ups, sole traders, small businesses, trades. The GDPR requires appropriate measures under Art. 32 for a level of security matching the risk. Without TOM, fines of up to €10 million or 2% of worldwide annual turnover are possible (Art. 83(4) GDPR). Which measures are actually meant is explained in our practical guide to TOM.
TOM must describe, among other things, the responsible party, technical measures (e.g. encryption, firewall), organisational measures (training, access rights), regular review, incident plans, pseudonymisation, and procedures for reporting security events. Creation often requires a current-state review, risk assessment, and ongoing documentation. Which measures are realistic for a small business and how to prioritise them is shown in our practical guide to technical and organisational measures. A short description of the TOM also belongs in the record of processing activities.
With Dieter you answer simple questions step by step; all mandatory details flow into your TOM document – including an access control concept. TOM can be updated whenever facts or law change.
TOM are mandatory as soon as personal data is processed. Art. 32 GDPR requires a level of security appropriate to risk – regardless of industry or company size.
Many searching for “create TOM” mean documenting technical and organisational measures in a legally sound way. That evidence is decisive in audits and with authorities.
Typical mistake
Individual measures like firewall or backups exist but are not documented as a coherent TOM concept.
Design depends on setup; typically it includes:
Start with a short current-state review: systems, data types, access, vendors, and typical risks. From that you derive appropriate technical and organisational measures.
With Dieter you answer relevant questions step by step, receive a consistent TOM document, and can update it when things change.
A DPA governs the contractual relationship between controller and processor. TOM describe the concrete security level of processing.
In practice you usually need both: the contract as legal framework and TOM as operational security evidence.
Update TOM when processing, tools, locations, access models, or vendors change materially.
Fixed review cycles (e.g. annually and after incidents) keep evidence robust and aligned with records, DPAs, and internal audits.
Recommendation
Define a clear update trigger per type of change so TOM do not go stale.
Start with Dieter now and document a level of protection appropriate to risk – including access control and evidence for authorities and partners.
Dieter guides you step by step through every relevant GDPR topic, explains each step in plain language and keeps content and requirements up to date. You stay on the safe side of data protection law and can get back to your actual work.
Dieter guides you through all mandatory information and turns it into a privacy policy that matches your company and your processes.
Use Cases:
Dirk
Owner at Kundegesucht
Use Cases:
Sofie
Founder at Miss Sofie's Coaching
Use Cases:
Larissa
Co-Founder at focus future
Use Cases:
Simon
Co-Founder at Dubly.AI GmbH
Use Cases:
Manuel
CEO at ALMAE Heilarbeitsinstitut GmbH
Use Cases:
Jarod
Sole proprietor at Jarod Schilke – IT Services
More reviews on OMR Reviews – Dieter and Google Reviews.
Meet our team, learn about the values and principles we work by and where we get involved.
We are a small, dedicated team of lawyers and techies working every day to make Dieter even better.
Transparency is close to our hearts and part of our DNA. In a dedicated overview we openly explain how we handle personal data – from technical measures and contracts to the services we use and your rights.
We are connected with recognised associations and initiatives in the data protection and legal tech space.
Get to know Dieter and take the first step towards a GDPR-compliant business.
Anyone searching for "create TOM" usually has two goals in practice: improving the level of security and making evidence auditable. TOM under Art. 32 GDPR must be documented in a risk-based, specific and understandable way. This makes visible how access, integrity, availability and recovery are actually safeguarded.
Robust TOM combine technical controls with organisational rules: permissions, roles, incident processes, training and review cycles. The key is linking each measure to a responsibility, so that a security intention becomes a reproducible operating standard. This keeps requirements manageable even when teams change or systems are replaced.
As soon as service providers, new applications or locations are added, TOM should be updated deliberately. The greatest impact comes from managing TOM consistently with DPA provisions and the record of processing activities. This reduces audit effort and strengthens your position towards customers and supervisory authorities.
A compliant privacy policy and legal notice belong on every successful website. DIETER was developed by data protection officers and lawyers to back you up and support GDPR compliance.
START GDPR CHECK-UPThe AI legal advisor for SMBs that turns regulation into action.
Meet Klaus. Klaus translates the EU AI Act into clear decisions: what is allowed, what is risky, and what to do right away. Deploy AI faster while reducing liability and approval risk.
