GDPR and managed cybersecurity: 10 technical controls to prove

• Article 32 Requires effective technical security: encryption, confidentiality, data recovery and regular evaluation.
• 72 hours The standard deadline for notifying the CNPD (the Portuguese data protection authority), counted from the moment the company becomes aware, using the dedicated form.
• Record everything Every breach is documented, including those that are never notified.
• Article 28 Whoever provides your IT services and accesses your data is, as a rule, a processor; the contract must comply with this article.

Regulation (EU) 2016/679 does not impose brands or products. It asks for security proportionate to risk. Article 32(1) lists examples: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; timely restoration of access to data after an incident; and regular testing of the effectiveness of the measures.

In management terms, four guarantees: access only for those who need it, controlled changes, recovery in good time and periodic verification. And personal data is anything that identifies a person: name, email, tax number, address, client file, payslip.

1. Personal data inventory: go through the server, Microsoft 365, billing, external drives, HR software and old mailboxes. Result: a table with the type of data, the system and the owner.
2. Least privilege: permissions defined by role: sales does not see salaries, reception cannot access the management folder. Every change of role triggers a fresh review.
3. Contracts with those who process data for you: IT provider, cloud, payroll. Article 28 requires sufficient guarantees and a written contract setting out instructions, confidentiality, security, conditions for using sub-processors, cooperation in a breach and return or destruction of data at the end. See what to check in exit and data clauses in an IT contract.

4. Multi-factor authentication: a large share of intrusions start with a compromised password. The second factor, usually on a phone, must protect email, cloud and remote access.
5. Encryption: one of the two measures named in Article 32 itself: encrypted disks on laptops, managed and locked phones, encrypted backups.
6. Updates with a set deadline: unpatched systems are the most common way to lose integrity and resilience. Set installation deadlines and retire equipment the manufacturer no longer supports.
7. Backups that are actually restored: without a tested restore, a backup is just a hypothesis. We recommend at least one test per quarter: see the 30-minute restore test and our managed backup service.

8. Access logs: sign-ins, access to sensitive folders, permission changes. In an incident, these records are what let you tell the authority which data was affected.
9. A plan for the first 72 hours: who decides, who gathers the technical information, who completes the notification. All agreed before it is needed.
10. A written annual review: the most forgotten Article 32 requirement. One review a year, with fixes recorded, is the best proof that the company acted diligently.

Article 33 and the CNPD's guidance set notification within 72 hours of becoming aware, unless the breach poses no risk to data subjects' rights. Where the risk is high, Article 34 also requires informing the data subjects themselves.

Two details catch many companies by surprise. Documenting is mandatory even when there is no notification. And the processor, IT provider included, must alert the client without undue delay. A lost laptop without encryption may constitute a breach; with an encrypted disk, the risk assessment is different.

Under a public contract with the União de Freguesias de Massamá e Monte Abraão, DataRoad installed and configured a new server, fitted a UPS (batteries that keep equipment running when the power fails), implemented local and cloud backups and migrated data and configurations. That is availability exactly as Article 32 describes it: data stored in more than one place and recoverable. Find out about the Massamá and Monte Abraão project.

We implement and document the technical controls, access, encryption, backups, updates, logs, firewall. We do not give legal advice. In 11 years, DataRoad has never suffered a security incident.

Every IT Unlimited contract includes security. With the Premium plan you also get unlimited on-site support, useful when physical work on a server or workstation is needed. Find out more about managed cybersecurity for businesses and the seven internal policies every company should have.

• EUR-Lex, GDPR, Regulation (EU) 2016/679 (Arts. 28, 32, 33 and 34)
• CNPD, Personal data breaches
• CNPD, Breach notification

In 10 working days we assess the ten controls across your systems and leave you, in writing, the gaps and the order in which to close them. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.