According to Art. 32 GDPR, controllers must implement appropriate technical and organisational measures (“TOMs”) to ensure a level of security appropriate to the risk. The choice of TOMs is made taking into account the state of the art, the costs, and the risks of processing. For processing likely to result in a high risk, a Data Protection Impact Assessment (“DPIA”) must be carried out in accordance with Art. 35 GDPR.

As your external DPO, we advise you on how to define and maintain a level of security appropriate to the risk.

We support you in assessing the adequacy of your technical and organisational measures and advise you on their optimisation so that you can effectively counter risks to personal data.

For new processing projects, we advise you on conducting risk assessments and guide you through the process of carrying out Data Protection Impact Assessments, from the methodology to advising on the derivation of risk-mitigating measures.