--- title: "GDPR and managed cybersecurity | DataRoad IT" description: "GDPR and managed cybersecurity: 10 technical controls under Art. 32, Art. 28 contracts and 72 hours to notify the regulator. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/ source: https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > GDPR and managed cybersecurity: 10 technical controls under Art. 32, Art. 28 contracts and 72 hours to notify the regulator. No-obligation proposal. # GDPR and managed cybersecurity: 10 technical controls to prove At a glance For decision-makers short on time. - 01 GDPR Article 32 requires encryption, access control, data recovery and regular testing. - 02 A breach is normally notified to the authority within 72 hours; it is always documented. - 03 Your IT provider is usually a processor, and the contract must comply with Article 28. - 04 DataRoad implements and documents the technical controls; it does not give legal advice. ### In this article **A personal data breach without documented technical measures turns an IT incident into a problem with the data protection authority, with clients and with the company's reputation.** For infrastructure, GDPR translates into ten controls within reach of any organisation above 10 workstations, to implement and, above all, to demonstrate. Here, DataRoad - IT Services and Consulting organises them into three blocks (know, protect, prove) and explains the first 72 hours after a breach. The legal side (lawful bases, consent, data subjects' rights) is left out; it belongs to your lawyer or data protection officer. ## GDPR and managed cybersecurity: what do you need to know now? - **Article 32** Requires effective technical security: encryption, confidentiality, data recovery and regular evaluation. - **72 hours** The standard deadline for notifying the CNPD (the Portuguese data protection authority), counted from the moment the company becomes aware, using the dedicated form. - **Record everything** Every breach is documented, including those that are never notified. - **Article 28** Whoever provides your IT services and accesses your data is, as a rule, a processor; the contract must comply with this article. ## What does the law require of infrastructure, without the legalese? Regulation (EU) 2016/679 does not impose brands or products. It asks for security proportionate to risk. Article 32(1) lists examples: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; timely restoration of access to data after an incident; and regular testing of the effectiveness of the measures. In management terms, four guarantees: access only for those who need it, controlled changes, recovery in good time and periodic verification. And personal data is anything that identifies a person: name, email, tax number, address, client file, payslip. ## Block 1, Know where the data is and who touches it - **Personal data inventory**: go through the server, Microsoft 365, billing, external drives, HR software and old mailboxes. Result: a table with the type of data, the system and the owner. - **Least privilege**: permissions defined by role: sales does not see salaries, reception cannot access the management folder. Every change of role triggers a fresh review. - **Contracts with those who process data for you**: IT provider, cloud, payroll. Article 28 requires sufficient guarantees and a written contract setting out instructions, confidentiality, security, conditions for using sub-processors, cooperation in a breach and return or destruction of data at the end. See what to check in [exit and data clauses in an IT contract](https://www.dataroad-it.com/en/msp-contract-exit-clauses-access-data/). ## Block 2, Protect against loss, theft and attack - **Multi-factor authentication**: a large share of intrusions start with a compromised password. The second factor, usually on a phone, must protect email, cloud and remote access. - **Encryption**: one of the two measures named in Article 32 itself: encrypted disks on laptops, managed and locked phones, encrypted backups. - **Updates with a set deadline**: unpatched systems are the most common way to lose integrity and resilience. Set installation deadlines and retire equipment the manufacturer no longer supports. - **Backups that are actually restored**: without a tested restore, a backup is just a hypothesis. We recommend at least one test per quarter: see [the 30-minute restore test](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) and our [managed backup](https://www.dataroad-it.com/en/managed-backup-services-portugal/) service. ## Block 3, Prove due diligence when someone asks - **Access logs**: sign-ins, access to sensitive folders, permission changes. In an incident, these records are what let you tell the authority which data was affected. - **A plan for the first 72 hours**: who decides, who gathers the technical information, who completes the notification. All agreed before it is needed. - **A written annual review**: the most forgotten Article 32 requirement. One review a year, with fixes recorded, is the best proof that the company acted diligently. ## What should you do in the 72 hours after a breach? Article 33 and the CNPD's guidance set notification within 72 hours of becoming aware, unless the breach poses no risk to data subjects' rights. Where the risk is high, Article 34 also requires informing the data subjects themselves. | When | What | Who | | --- | --- | --- | | Detection | Technical alert, complaint, ransom demand or missing laptop | The employee who detects it, informing support | | Following hours | Containment: isolate machines, block accounts, preserve logs | IT technical team | | First day | Establish which data and how many data subjects are involved | IT and management | | By day 3 | Decide and, if required, submit the form to the CNPD | The company, as data controller | | In every case | Record the breach, its consequences and the measures taken | The company | Two details catch many companies by surprise. Documenting is mandatory even when there is no notification. And the processor, IT provider included, must alert the client without undue delay. A lost laptop without encryption may constitute a breach; with an encrypted disk, the risk assessment is different. ## Real example: continuity at a public body Under a public contract with the União de Freguesias de Massamá e Monte Abraão, DataRoad installed and configured a new server, fitted a UPS (batteries that keep equipment running when the power fails), implemented local and cloud backups and migrated data and configurations. That is availability exactly as Article 32 describes it: data stored in more than one place and recoverable. [Find out about the Massamá and Monte Abraão project](https://www.dataroad-it.com/en/massama-monte-abraao-server-ups-backups/). ## How does DataRoad's managed cybersecurity help? We implement and document the technical controls, access, encryption, backups, updates, logs, firewall. We do not give legal advice. In 11 years, DataRoad has never suffered a security incident. Every IT Unlimited contract includes security. With the [Premium plan](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/) you also get unlimited on-site support, useful when physical work on a server or workstation is needed. Find out more about [managed cybersecurity for businesses](https://www.dataroad-it.com/en/managed-cybersecurity-services/) and the [seven internal policies every company should have](https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/). ## Frequently asked questions ### Do we have to encrypt all data to comply with GDPR? Encrypting everything is not mandatory, but encryption is expressly named as an appropriate measure. On backups, phones and laptops it is the simplest way to stop a loss becoming a serious breach. ### Does a lost laptop have to be reported to the authority? Only if there is a risk to the data subjects. If the disk is encrypted and wiped remotely, that risk falls sharply. The incident is always recorded, and the decision rests with the data controller, with legal support where needed. ### Does our IT partner count as a processor? Yes, in most cases, provided it accesses systems containing personal data. The contract must then comply with Article 28: instructions, confidentiality, security, cooperation in incidents and return or destruction of data. ### What is the deadline for notifying a breach? As a rule, 72 hours from when the company becomes aware, using the form provided by the CNPD. If that deadline is missed, the notification must explain the delay. ## Sources - [EUR-Lex, GDPR, Regulation (EU) 2016/679 (Arts. 28, 32, 33 and 34)](https://eur-lex.europa.eu/legal-content/PT/TXT/HTML/?uri=CELEX:32016R0679) - [CNPD, Personal data breaches](https://www.cnpd.pt/organizacoes/outras-obrigacoes/violacao-de-dados-ou-data-breach/) - [CNPD, Breach notification](https://www.cnpd.pt/DataBreach/DataBreach_pt.aspx) ## Want to know what your infrastructure is missing? In 10 working days we assess the ten controls across your systems and leave you, in writing, the gaps and the order in which to close them. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)[Managed IT and cybersecurityManaged backup: the 30-minute restore test that proves itA backup never restored is a deferred risk. In 30 minutes, an old document, a deleted email and a server booted in isolation show whether th…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/managed-backup-30-minute-restore-test/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **Top 5%** SMEs · scoring.pt - **11** years in business, since 2015 - **0** DataRoad security incidents in 11 years We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/