How does a small company describe its technical and organisational security measures?

Article 32(1) GDPR says the controller and the processor implement appropriate technical and organisational measures, taking into account the state of the art, costs, the nature of the processing and the risk to people. It gives four examples, "as appropriate":

• (a) pseudonymisation and encryption;
• (b) ongoing confidentiality, integrity, availability and resilience of systems;
• (c) the ability to restore data in a timely manner after an incident;
• (d) regular testing and evaluation of the measures.

Article 32(2) names what to protect against: accidental or unlawful destruction, loss, alteration, disclosure of or access to data. Article 32(4) adds the human side: staff process data only on your instructions.

In other words, measures must be proportionate. A dental clinic processing health data needs more than a restaurant that stores only table bookings.

Not only so that the measures exist. Article 24(1) GDPR requires the controller to be able to demonstrate compliance. You will also use the description in three places:

1. In the record – Article 30(1)(g) GDPR: where possible, a general description of security measures.
2. In supplier contracts – Article 28(3)(c) GDPR requires the processor to take the Article 32 measures; if you are the supplier, the customer will ask for your description.
3. After a breach – when you assess the risk, the description shows whether the data was encrypted and whether a backup exists.

Here is an example for a company with up to 50 employees. The columns matter more than the specific rows.

The last column is Article 32(1)(d) GDPR in practice. A measure nobody checks may stop working within a year.

Add rows where your risk is higher:

• Dental clinic, outpatient clinic, pharmacy – health data: access logs showing who opened a patient record; stronger encryption.
• Online shop – card payments through a payment service provider, so card data never enters your system; protection of admin accounts.
• Transport company – GPS data access only for those responsible; retention period set automatically in the system.
• Sports club – access to the entry-control system; if entry uses biometric data to identify a person, that is special-category data: processing it is prohibited unless an exception in Article 9(2) GDPR applies (usually explicit consent, with an alternative for those who refuse), and a DPIA may be needed (VDAI list point 4).
• Apartment building management – access to residents' data and camera footage; a procedure for handing over recordings.

Article 25(1) GDPR adds one more principle: data protection must be built in from the start when you choose a system. When buying new software, ask about the rows of this table before you sign.

1. The description is copied from a large company's template. 40 measures, half of which do not exist. A customer or VDAI will ask about one you do not have.
2. No owner. "The company ensures" is not a measure. A measure is what a named person does.
3. The description is never updated. You changed your email system or IT provider – change the description too.

Fill in the table with your IT provider – they know half the answers. Then enter the general description in your record of processing activities. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record; a record can also be ordered as a one-off procedure for €95 excl. VAT.

Is ISO 27001 certification mandatory?
No. Article 32(3) GDPR lets an approved certification under Article 42 serve as one element of proof; it is not a duty. ISO 27001 is not such a mechanism, although it can help show that measures are in place.

Do we have to show the description to customers?
Not all of it. The general description – yes, if you are their processor and they ask. Password or network details stay internal.

How many measures are enough?
As many as your risk requires. A small company with orderly access, encryption, backups and supplier contracts usually covers the main risk.

Is staff training mandatory?
The GDPR does not name it as a separate duty, but Article 32(4) requires you to take steps to ensure that staff process data only on instructions. Training is the usual way to do that and to prove it.

• Who in the company may see employee data? (in Lithuanian)
• A customer sent a GDPR questionnaire: how to fill it in
• Breach register: what to record
• Record of processing activities: the Article 30 fields in plain language

The law and the risk: What a GDPR document package contains and why we prepare it only after an audit – dat.lt

• Special-category (biometric) data – Article 9(1) and 9(2) GDPR; VDAI Director's order No. 1T-35 (1.12.E) of 2019-03-14, list point 4.
• Appropriate security measures and four examples – Article 32(1)(a) to (d) GDPR; the risks to consider – Article 32(2); certification as evidence – Article 32(3); staff act only on instructions – Article 32(4).
• Integrity and confidentiality principle – Article 5(1)(f) GDPR.
• Duty to demonstrate compliance – Article 24(1) GDPR.
• Data protection by design – Article 25(1) GDPR.
• Processor must take Article 32 measures – Article 28(3)(c) GDPR.
• Security measures in the record – Article 30(1)(g) GDPR.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). This text is general information and is not individual legal advice.