In this article
For IT infrastructure, the GDPR comes down to ten technical and organisational measures that a company with more than 10 workstations can implement and demonstrate. Map the data, restrict access, enable MFA, encrypt, make and test backups, update, log access, put contracts in place with processors, have a 72-hour plan and review annually. This article covers only the technical side; the legal basis for processing, consents and data subjects' rights are matters for your lawyer or data protection officer.
Four facts to remember
- Article 32 Requires specific technical measures: encryption, confidentiality, the ability to restore data and regular testing.
- 72 hours The standard deadline for notifying the CNPD (the Portuguese data protection authority) of a personal data breach, counted from when the company becomes aware of it, using the official form.
- Mandatory documentation Every breach is recorded, even those not notified.
- Article 28 An IT provider with access to your data is, as a rule, a processor, and the contract must comply with this article.
What Article 32 requires, in management terms
Regulation (EU) 2016/679 does not say what equipment to buy; it requires security appropriate to the risk. Article 32(1) gives examples: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; the ability to restore access to data in a timely manner after an incident; and a process for regularly testing the effectiveness of the measures.
In plain terms: only those who should see the data can see it, nobody changes it without control, the company can recover it in time if everything fails, and all of this is tested. Personal data is any data about an identifiable person — names, emails, tax numbers, addresses, client files, payslips.
The 10 measures, in order of implementation
1. Personal data map
Server, Microsoft 365, invoicing, HR software, external drives, old emails. The result is a simple table: what data, in which system, with which owner.
2. Least-privilege access
Permissions by role — sales staff do not open payslips, reception does not enter the management folder — reviewed whenever someone changes role.
3. MFA on everything exposed
Most unauthorised access starts with a stolen password. The second factor, usually on a mobile phone, should be active on email, the cloud and remote access.
4. Encryption on laptops, phones and copies
It is one of the two examples Article 32 names: encrypted disks on every laptop, locked and managed phones, encrypted backups.
5. Backups with tested restores
A backup that has never been restored proves nothing. We recommend at least one restore test per quarter — see how to test a backup in 30 minutes and our managed backups.
6. Updates with deadlines
Unpatched systems are the most common way to lose integrity and resilience. Set installation deadlines and replace equipment no longer supported by the manufacturer.
7. Access logs
Sign-ins, access to sensitive folders and permission changes. These logs answer the CNPD's question in an incident: what data was affected?
8. Contracts with processors
IT provider, cloud, payroll software: Article 28 requires sufficient guarantees and a written contract with documented instructions, confidentiality, security measures, rules for engaging sub-processors, assistance in the event of a breach and return or deletion of the data at the end. What to check: exit and data clauses in the IT contract.
9. Plan for the first 72 hours
Who decides, who gathers the technical information, who completes the notification — defined before it is needed.
10. Documented annual review
The most overlooked point of Article 32. One review a year, with recorded corrections, is also the best evidence of due diligence.
Timeline of a data breach
Under Article 33 and CNPD guidance, notification must be made within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights. If the risk is high, Article 34 also requires informing the data subjects.
| Moment | Action | Responsible |
|---|---|---|
| Hour 0 | Detection: alert, complaint, ransom demand, lost laptop | Any employee alerts support |
| First hours | Containment: isolate devices, block accounts, preserve logs | IT team |
| Within 24 hours | Establish what data and how many people were affected | IT with management |
| Within 72 hours | Decide and, where applicable, notify the CNPD using the form | Controller (the company) |
| Always | Document the breach, its effects and the measures taken | Company |
Two points that surprise people: the obligation to document applies even without notification; and the processor — including the IT provider — must inform the client without undue delay. A lost laptop without encryption may be a breach; with encryption, the risk assessment changes completely.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
In practice: availability at a public body
At the União de Freguesias de Massamá e Monte Abraão, DataRoad was selected through a public contract to install and configure a new server, implement a UPS (the battery that keeps equipment running during a power cut), set up local and cloud backups and migrate data and configurations. This is what Article 32 asks for in terms of availability: data in more than one location and capable of being restored. Read the Massamá and Monte Abraão case.
Where managed cybersecurity comes in
DataRoad implements and documents the technical measures — access, encryption, backups, updates, logs, firewall — and does not provide legal advice. In 11 years, DataRoad has never suffered a security incident. Security is included in the IT Unlimited plans; IT Unlimited Premium adds unlimited on-site support, useful when work is needed on a server or workstation. More in managed cybersecurity for businesses and in the 7 internal cybersecurity policies.
Frequently asked questions
Does the GDPR require all data to be encrypted?
It does not require everything to be encrypted, but it names encryption as an appropriate measure. On laptops, phones and backups it is the simplest way to stop a loss becoming a serious breach.
Does losing a laptop require notifying the CNPD?
It depends on the risk to data subjects. An encrypted disk that is wiped remotely carries much lower risk. The incident is always documented; the decision lies with the controller, with legal support if needed.
Is the IT provider a processor?
As a rule, yes, when it accesses systems containing personal data. The contract must comply with Article 28: instructions, confidentiality, security, assistance with incidents and return or deletion of the data.
What is the deadline for notifying a breach?
As a rule, 72 hours after becoming aware, using the CNPD form. Beyond that deadline, the notification must state the reasons for the delay.
Sources
Next step: GDPR technical assessment in 10 working days
We check the 10 measures across your infrastructure and deliver a report on what is missing, with a no-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
