GDPR and Cyber Security: How Data Protection Works in Practice

Many organizations still approach the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR) primarily as legal or compliance requirements, yet they have become two of the most influential cyber security frameworks in practice. They now shape how businesses protect personal data, manage cyber risk, and build operational resilience across their entire technology landscapes.

Today’s cyber threats, include ransomware, phishing, credential theft, insider threats, and supply chain attacks with regulators intensifying scrutiny across finance, healthcare, retail, manufacturing, and energy.

EU GDPR and UK GDPR both require organizations to implement “appropriate technical and organizational measures” to protect personal data, including encryption, access control, monitoring, resilience, testing, secure storage, incident response planning, and continuous risk assessment. These are regulatory expectations, not optional IT best practices.

This article explains the key EU/UK GDPR security requirements and practical implications for security teams and operations.

IMPORTANT NOTICE: THIS ARTICLE PROVIDES GENERAL INFORMATION ONLY AS AT PUBLISHED DATE AND DOES NOT CONSTITUTE LEGAL ADVICE. DATA PROTECTION AND CYBER SECURITY REQUIREMENTS AND REGULATORY TIMING VARY BY JURISDICTION AND MAY CHANGE. ORGANIZATIONS SHOULD OBTAIN ADVICE ON THEIR SPECIFIC CIRCUMSTANCES AND APPLICABLE LAW.

What are EU & UK GDPR and what do they cover?

The GDPR exists in two parallel regimes: (i) the EU GDPR, which applies to the processing of personal data of individuals in the EEA under its territorial scope rules, and (ii) the UK GDPR, which applies in the United Kingdom alongside the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Both may apply extraterritorially where goods or services are offered to, or behavior monitored of, individuals in their respective jurisdictions.

The EU GDPR is enforced by EEA supervisory authorities coordinated by the European Data Protection Board (EDPB), while the UK GDPR is enforced by the UK Information Commissioner’s Office (ICO).

Jurisdictional note: EU GDPR and UK GDPR obligations are broadly aligned but can differ in supervisory practice and guidance. Organizations operating in both the EU/EEA and the UK should carry out separate assessments for each regime, including for international transfers and with reference to applicable local guidance.

Personal data includes far more than names and email addresses. Under Article 4 EU/UK GDPR, information such as IP addresses, device identifiers, employee HR records, financial information, health data, location data, browsing behavior, and biometric information may be personal data when linked to an identifiable individual. Article 9 EU/UK GDPR identifies special category data requiring enhanced protection, including health and biometric data used for identification.

EU/UK GDPR govern how personal data is collected, stored, used, shared, and deleted. It also gives individuals rights, including access, rectification, erasure, portability and restriction.

Why this matters for security teams

Organizations must protect personal data against unauthorized access, accidental disclosure, theft, corruption, destruction, and loss of availability. This is why cyber security has become a board level business risk under GDPR, driven in part by the potential for substantial regulatory fines and reputational damage.

How GDPR fits with other EU/UK cyber regulations

Neither EU GDPR nor UK GDPR replaces sector-specific regimes; they sit alongside them within a broader regulatory landscape. In the EU, the Network and Information Security 2 Directive (NIS2) set enhanced cyber resilience duties for entities in essential and important sectors, including phased incident reporting, with applicability and scope differing by sector and Member State, and requiring confirmation against national rules and guidance.

Separately, the EU Digital Operational Resilience Act (DORA) applies to financial entities and certain ICT third-party service providers, with rules on ICT risk management, governance, incident reporting, resilience testing and third-party oversight. DORA scope and obligations vary by entity type and classification.

In the UK, the UK NIS regime and sector-specific rules operate alongside the UK GDPR.

These regimes apply differently across jurisdictions and should be mapped to each organization’s footprint, with separate assessments for EU/EEA and UK operations, including transfers and local guidance.

Article 32 EU/UK GDPR: Security of processing explained

Article 32 requires organizations to implement “appropriate technical and organizational measures” to ensure a level of security appropriate to the risk, taking account of the sensitivity of the data, operational scope, and the potential impact of a breach on individuals.

These are risk-based requirements, not a fixed compliance checklist. For example, a global healthcare provider handling sensitive patient records will be expected to maintain stronger controls than a small organization processing basic contact information, reflecting both the nature of the data and the potential consequences of a breach.

What “appropriate technical and organizational measures” means

In practice, “appropriate” measures include encryption, multi-factor authentication, access management, backup and recovery, vulnerability management, security monitoring, incident response, resilience planning, and staff awareness training implemented in line with risk.

This reflects GDPR’s shift toward continuous accountability, requiring proof that measures are effective, proportionate, and consistently applied. Organizations are expected to carry out risk assessments, document decisions, and regularly review controls to align with evolving threats and expectations.

Confidentiality, integrity, and availability

GDPR security obligations are built around confidentiality, integrity, and availability.

Confidentiality limits access to authorized users via controls such as multi-factor authentication, role-based access controls, encryption, and network segmentation with least-privilege configuration.

Integrity protects against unauthorized alteration through audit logging, changing management, and file integrity monitoring, while availability requires resilient infrastructure, backups, and disaster recovery planning and processes.

Ransomware or other events that make data unavailable may be reportable depending on the assessed risk to individuals and applicable criteria.

Encryption, pseudonymization, and layered security

Encryption should be considered and implemented proportionately to risk. Encryption is referenced in Article 32 because it can reduce the risk of unauthorized access and should be applied to data in transit, and data at rest across endpoints, servers, backups, and cloud, including the possible use of hardware encrypted storage devices where appropriate.

This is particularly important for remote work and hybrid-cloud operations. However, encryption alone is not enough and must be part of; a layered security model, alongside strong access management, monitoring, incident response, staff training, and ongoing testing.

Pseudonymization can reduce risk by separating identifying information from datasets with appropriate safeguards. Regulatory guidance and recent enforcement trends emphasize that pseudonymization is a valuable safeguard but does not take data outside the scope of GDPR where re-identification remains possible.

Organizations are increasingly expected to assess how effective pseudonymization is in practice, including who holds additional information and controls to prevent re-identification. Pseudonymization is also relevant as a supplementary safeguard for international data transfers.

International transfers after Schrems II

International data transfers remain a key focus area. After the Schrems II judgment, organizations cannot rely on transfer tools such as contractual clauses alone. They should document transfer risk assessments and, where needed, add supplementary measures such as encryption, segregation of keys, and robust pseudonymization.

Regulators increasingly expect organizations to assess risks to individuals’ rights and freedoms and to document their decisions. In practice, organizations should use appropriate mechanisms, including adequacy decisions, the European Commission’s 2021 Standard Contractual Clauses (SCCs), and, for certified recipients, the EU–US Data Privacy Framework (DPF), with pseudonymization recognized as an important safeguard where properly implemented.

Testing, monitoring, and continuous evaluation

Organizations should regularly test and evaluate their security controls through vulnerability scanning, penetration testing, continuous monitoring, security audits, incident response exercises, and backup restoration testing; to verify ongoing effectiveness. Monitoring and visibility are essential for early detection, limiting disruption, and meeting breach notification duties.

Many organizations now align their GDPR programs with recognized frameworks such as ISO/IEC 27001, ISO/IEC 27701, the NIST Cybersecurity Framework, or Cyber Essentials tailored to their risk profile.

How GDPR affects cyber security strategies

A GDPR-aligned strategy centers on accountability, risk assessment and third-party oversight. Organizations should be able to demonstrate compliance with documented risk assessments, records of processing, incident response procedures, and supplier oversight, with clear evidence of decision-making and reviews.

This includes recording breach decisions (including whether an incident is reportable), assessing impact on individuals, and showing that key controls (such as encryption, monitoring and access management) are effective. In practice, this means that security investment should reflect threats, vulnerabilities, and data sensitivity.

Third-party risk management is critical because controllers remain responsible for processors, requiring due diligence before engaging processors, contractual oversight, and ongoing monitoring.