Written by the GDPR Exam Trainer Editorial Team for DPO exam candidates. Statements are checked against Regulation (EU) 2016/679 on EUR-Lex and Case C-492/23; no natural person is named as author. Builds on Article 25 by design / by default and the Article 5 principles. A typical candidate question is whether every organisation must encrypt personal data. That is a study question, not a legal source.
Does GDPR require encryption?
No. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity, Article 32(1) requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate the pseudonymisation and encryption of personal data.
The list is introduced by including inter alia as appropriate. Recital 83 tells the controller or processor to evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Article 32(1) also names confidentiality, integrity, availability, resilience, restore capability and regular testing. See also anonymisation versus pseudonymisation.
Which measures does Article 32 name?
Article 32(1) names four groups: (a) pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of those measures.
Article 32(2) requires account of risks from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Article 32(3) provides that adherence to an approved code of conduct under Article 40 or an approved certification mechanism under Article 42 may be used as an element by which to demonstrate compliance with paragraph 1. Article 32(4) requires the controller and processor to take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.
Who must implement Article 32 — controller or processor?
Article 32(1) and Article 32(4) bind the controller and the processor.
Article 25 addresses the controller. A processor still has its own Article 32 duty, alongside the contract duties in Article 28.
How does Article 32 differ from Article 25 and Article 5(1)(f)?
Article 5(1)(f) is the integrity and confidentiality principle; Article 24 is the controller's duty to implement and demonstrate measures; Article 25 is data protection by design and by default for the controller; Article 32 is the security-of-processing duty for controller and processor.
| Provision | Who | What it requires | Encryption |
|---|---|---|---|
| Article 5(1)(f) | Principle | Appropriate security, including protection against unauthorised processing and accidental loss, destruction or damage. | Not named |
| Article 24(1) | Controller | Implement and demonstrate compliance measures; review and update where necessary. | Not named |
| Article 25(1) | Controller | By design: measures such as pseudonymisation for principles such as data minimisation. | Not named |
| Article 32(1) | Controller and processor | Security appropriate to the risk, including the four lettered capabilities. | Named in (a), as appropriate |
| Article 34(3)(a) | Controller | No data-subject communication if appropriate protection measures were applied to the affected data, in particular those that render the data unintelligible, such as encryption. | Named as an example |
What did the CJEU decide in Russmedia (C-492/23)?
On 2 December 2025 the Grand Chamber held, in operative part 2 of EuGH C-492/23 Russmedia Digital and Inform Media Press, that the operator of an online marketplace, as controller of personal data in advertisements published there, must implement appropriate technical and organisational security measures to prevent advertisements containing sensitive data, in terms of Article 9(1), from being copied and unlawfully published on other websites.
Paragraph 117: the reference in Article 32(1) and (2) to a level of security appropriate to the risk shows that the Regulation establishes a risk management system and in no way purports to eliminate the risks of personal data breaches. Paragraph 118: Article 32, read with Article 24, merely requires measures intended to avoid, in so far as it is at all possible, any personal data breach, assessed in a concrete manner. Paragraph 120: once an advertisement containing personal data is online, dissemination can entail a loss of control which, where it happens, deprives of practical effect the rights and safeguards provided for by the GDPR, foremost the right to erasure in Article 17. Paragraph 121: where sensitive data are published online, the controller is required under Article 32 to take all technical and organisational measures to ensure a level of security apt to effectively prevent the occurrence of a loss of control over those data. Paragraph 122: the controller must consider in particular all technical measures available in the current state of technical knowledge that are apt to block the copying and reproduction of online content. Paragraph 123: Articles 24 and 32 cannot be understood as meaning that the unlawful dissemination of personal data initially published online is sufficient to conclude that the measures were not appropriate, without even allowing the controller to adduce evidence to the contrary. Operative part 1 interprets Article 5(2) and Articles 24 to 26, including identify, verify and refuse duties for Article 9 data; it is not the Article 32 answer. See also Article 26 joint control.
Does encryption change GDPR breach notification?
Encryption is named in Article 34(3)(a) as an example of a measure that can render personal data unintelligible, which is one of three alternative conditions under which communication of a personal data breach to the data subject is not required. It is not a waiver of Article 33 notification to the supervisory authority.
Article 4(12) defines a personal data breach as a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Article 33(1) requires the controller, without undue delay and, where feasible, not later than 72 hours after becoming aware of it, to notify the supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Detail: breach-notification guide.
Which Article 83 fine tier lists Article 32?
Article 83(4)(a) lists the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43 in the tier of administrative fines up to 10 000 000 EUR, or for an undertaking up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher. Article 32 sits inside Articles 25 to 39.
Article 83(5)(a) lists the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9, in the higher tier of up to 20 000 000 EUR or 4 %. The same facts can engage more than one provision. See how GDPR fines are calculated.
Frequently asked questions
Does GDPR Article 32 require encryption?
No. Article 32(1), taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity, requires a level of security appropriate to the risk and lists encryption, with pseudonymisation, as a measure including inter alia as appropriate. Recital 83 names encryption as an example of a measure to mitigate risks inherent in the processing.
Who must implement Article 32 — the controller or the processor?
Both. Article 32(1) and Article 32(4) address the controller and the processor. Article 25 addresses the controller alone.
How does Article 32 differ from Article 25?
Article 25 requires the controller to implement measures designed to apply data-protection principles, such as data minimisation. Article 32 requires the controller and the processor to ensure a level of security appropriate to the risk.
Does a later copy of an online advertisement prove that Article 32 was breached?
Not by itself. In EuGH C-492/23 Russmedia (Grand Chamber, 2 December 2025, paragraph 123) the Court held that Articles 24 and 32 cannot be understood as meaning that the unlawful dissemination of personal data initially published online is sufficient to conclude that the measures adopted by the controller concerned were not appropriate, without even allowing that controller to adduce evidence to the contrary.