# What security measures does the GDPR actually require?

It requires measures appropriate to the risk, not a fixed list. The controller and the processor must take technical and organisational measures that fit the state of the art, the cost of implementation, the nature and purpose of the processing and the likelihood and severity of harm to people. The GDPR gives examples: pseudonymisation and encryption, the ability to keep systems confidential, intact, available and resilient, the ability to restore data after an incident, and a process to test and evaluate the measures regularly. So a company has to decide, document and review what is appropriate for its own data, and be able to explain why. Being able to notice a breach is part of this, since you cannot report or contain what you do not see, and a breach often comes to light through unusual network activity. NetSenX can be one of those measures: it detects beaconing, scanning, lateral movement and unusual outbound data volume on every plan. Whether your overall set of measures is appropriate remains your assessment.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-security-does-the-gdpr-require

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [Does our company need a data protection officer?](https://netsenx.com/en/faq/do-we-need-a-data-protection-officer)
- [Can we monitor our network for security on the basis of legitimate interest?](https://netsenx.com/en/faq/can-we-monitor-the-network-under-legitimate-interest)
- [How high can GDPR fines be?](https://netsenx.com/en/faq/what-are-gdpr-fines)
- [What is DORA, in plain terms?](https://netsenx.com/en/faq/what-is-dora-in-plain-terms)
- [What does DORA require from the management of a financial entity?](https://netsenx.com/en/faq/what-does-dora-require-from-management)