Technical and organisational measures (TOMs) in practice

In short: TOMs are the protective measures by which a company secures personal data: from access rights and encryption to training and emergency plans.

In more detail: Art. 32 GDPR requires “appropriate technical and organisational measures”, depending on state of the art, costs, nature and scope of processing and risk to data subjects. In contracts (data processing), privacy documentation and audits a TOM list therefore always appears. This is general information and not legal advice; laws change and individual cases can differ. For concrete problems counselling (consumer advice, lawyer, data protection authority) helps.

In Depth

Technical measures (examples)

• Encryption of data at rest and in transit (TLS, disk/database encryption).
• Access control: user accounts, roles and rights, two-factor, password policies, lockout after failed attempts.
• Pseudonymisation/anonymisation.
• Logging and monitoring.
• Backups and restore tests, resilience.
• Firewalls, updates/patch management, antivirus, network segmentation.
• Separation of test/production data, tenant separation.

Organisational measures (examples)

• Policies (privacy, passwords, clean desk, mobile devices).
• Training and confidentiality obligation of employees.
• Authorisation concept (need-to-know), joiner/leaver processes.
• Data processing agreements with service providers, supplier checks.
• Emergency and reporting process for data breaches (72 hours).
• Deletion concept and retention periods.
• Visitor rules, locking system, file destruction.
• Regular review and documentation (check effectiveness).

Structuring by protection goals

TOMs are often structured by goals: confidentiality (entry, access, authorisation control, separation), integrity (transfer, input control), availability and resilience (backup, recovery), procedures for regular review. This lets them be assigned to the risk determined, for example, by the protection requirement assessment.

Practice for small businesses

Start with a short list of the measures actually implemented: password manager, updates, backups, device encryption, two-factor, access rights, training, contract templates. Document honestly what really applies, not wish lists. Review at least annually. Templates are provided by supervisory authorities, BSI Grundschutz, industry associations.

See also: Protection requirement assessment, Data processing agreement (DPA), Data breach and notification duty, ISO 27001 and BSI Grundschutz