What security measures does the GDPR actually require?

It requires measures appropriate to the risk, not a fixed list. The controller and the processor must take technical and organisational measures that fit the state of the art, the cost of implementation, the nature and purpose of the processing and the likelihood and severity of harm to people. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). gives examples: pseudonymisation and encryption, the ability to keep systems confidential, intact, available and resilient, the ability to restore data after an incident, and a process to test and evaluate the measures regularly. So a company has to decide, document and review what is appropriate for its own data, and be able to explain why. Being able to notice a breach is part of this, since you cannot report or contain what you do not see, and a breach often comes to light through unusual network activity. NetSenX can be one of those measures: it detects beaconing, scanning, lateral movement and unusual outbound data volume on every plan. Whether your overall set of measures is appropriate remains your assessment.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics