In summary
- The GDPR is not just a legal issue: Article 32 requires specific technical measures — encryption, confidentiality, the ability to recover data and regular testing.
- A personal data breach must, as a rule, be reported to the CNPD within 72 hours of the company becoming aware of it, using the appropriate form.
- All violations must be documented, even those that are not reported.
- The computer company that accesses your data is, as a rule, a subcontractor: the contract must comply with Article 28.
In this article
The GDPR in the IT of SMEs It translates into ten technical and organizational steps that any company with more than 10 employees can put into practice: knowing where the data is stored, controlling who has access to it, encrypting, making and testing backups, maintaining records, having the right contracts with suppliers and knowing what to do in the first 72 hours of an incident. This article deals only with that aspect — what IT has to ensure. It is not legal advice: for the legal basis of processing, consents and the rights of data subjects, please consult your lawyer or data protection officer.
What the GDPR requires from IT
The General Data Protection Regulation (Regulation (EU) 2016/679) does not say that you need to buy a firewall. It does say that security must be appropriate to the risk, and it gives examples in Article 32(1):
- the pseudonymization and encryption of personal data;
- the ability to ensure the permanent confidentiality, integrity, availability and resilience of the systems;
- the ability to restore the availability and access to data in a timely manner after an incident;
- a process to test and regularly evaluate the effectiveness of the measures.
The 10 steps
1. Knowing where personal data is stored
Server, Microsoft 365, billing program, human resources software, external drives, old emails. What you don't know doesn't exist. The result of this step is a simple map: which data, on which system, who is responsible.
2. Grant access only to those who need it
The commercial does not need to see the expiration receipts; the reception department does not need the administration folder. Permissions are granted by function, reviewed whenever someone changes roles.
3. Protect accounts with MFA
Most unauthorized access starts with a stolen password. Multi-factor authentication (the second confirmation step, usually on the mobile phone) must be active in the email, the cloud, and the remote access.
4. Encrypt portable devices, mobile phones and copies
Encryption is one of the two examples that Article 32 itself names. In practice: encrypted discs on all laptops, mobile phones with locking and management, encrypted backups.
5. Backing up and testing them
Article 32 talks about restoring access “in a timely manner”. A backup that has never been restored proves nothing. We recommend a restore test at least once a quarter — see the 30-minute backup test and ours backup solutions.
6. Keep the systems updated
Systems without security patches are the most common way to lose the “integrity and resilience” that the regulation requires. Fixed-term updates and equipment without manufacturer support are replaced.
7. Keep records of who accessed what
Log records of logins, access to sensitive folders, and permission changes. These records allow us to answer, in the event of an incident, the question that the CNPD will ask: which data was affected?
8. Having the right contracts with the subcontractors
Anyone who processes data on behalf of their company — the IT company, the cloud provider, the payroll software — is a subcontractor. Article 28 requires that only subcontractors who provide sufficient guarantees and that the relationship is in a written contract with documented instructions, confidentiality, security measures, rules for subcontracting third parties, support in case of breach, and the return or deletion of data at the end of the service be used. We explain what to check Computer contract: exit clauses and data.
9. Having a plan for the first 72 hours
See the next section. The plan should state who decides, who collects the technical information and who fills out the notification.
10. Testing and reviewing every year
The last point of Article 32 is the most forgotten: regularly assessing whether the measures are working. An annual, documented review with corrections made is also the best proof of diligence.
Data breach: the 72-hour clock
According to Article 33 of the GDPR and the CNPD, the notification of a personal data breach must be made within 72 hours after the company became aware of it, unless the breach is unlikely to result in a risk to the rights of individuals. The CNPD provides a specific form for this purpose. When the risk is high, Article 34 also requires the affected individuals to be informed.
| Moment | What has to happen | Who |
|---|---|---|
| Hour 0 | Incident detection (alert, complaint, ransom demand, lost portable) | Any collaborator notifies the support team |
| First hours | Contain: isolate equipment, block accounts, preserve records | Information Technology |
| Until 24 hours | Understanding the data and how many people were affected | Information Technology with Administration |
| Until 72 hours | Decide and, if applicable, notify the CNPD using the appropriate form | Responsible for the treatment (the company) |
| Always | Documenting the violation, its effects, and the measures taken | Company |
Two points that surprise many managers. First, the obligation to document exists even when there is no notification: the CNPD reminds that the responsible person is obliged to document any violations. Second, the subcontractor — including the IT company — must notify the client without undue delay when they become aware of a violation. A laptop lost without a password can be a data breach; with a password, the risk assessment is very different.
A real case: server, UPS and backups in a public entity
In the Union of Freguesias of Massamá and Monte Abraão, DataRoad was chosen by public contract to install and configure a new server, implement a UPS system (the battery that keeps the equipment running in the event of a power outage), set up local and cloud backups, and migrate the data and settings to the new infrastructure. In practice, this is what Article 32 requires regarding availability: the data exists in more than one place and can be restored. Read the case study Public contract 2022 in Massamá and Monte Abraão.
DataRoad implements the technical measures — access controls, encryption, backups, updates, logs, firewall — and documents them. It does not provide legal advice. Security is included in the IT Unlimited plans; the Premium plan It combines on-site assistance, useful when it is necessary to intervene on a server or a station. See also our approach to cyber security for business and is 7 internal cybersecurity policies.
Frequently Asked Questions
Does the GDPR require the encryption of all data?
It does not require encrypting everything, but it does name encryption as an example of an appropriate measure in Article 32. In portable devices, mobile phones and backups, it is the simplest and cheapest way to reduce the risk of a loss turning into a serious breach.
Do we have to notify the CNPD if we lose a laptop?
It depends on the risk to the people whose data was on the equipment. A laptop with the disk encrypted and erased remotely has a much lower risk than a laptop without protection. In any case, the incident must be documented. The final decision rests with the person responsible for the processing, with legal support if necessary.
Is the IT company a subcontractor?
As a rule, yes, when they have access to systems with personal data. Therefore, the contract must comply with Article 28 of the GDPR: instructions, confidentiality, security, incident support, and the return or deletion of the data at the end.
How long do we have to notify a violation?
As a rule, 72 hours after learning of the violation, through the CNPD form. If the notification is not made within that timeframe, it must be accompanied by the reasons for the delay.
Technical diagnosis RGPD within 10 working days
We checked the 10 steps in your infrastructure — access, MFA, encryption, backups, updates, logs, and incident plan — and delivered a report with the missing technical measures. For companies with more than 10 seats · contract support · remote, on-site, and phone support.
Technical diagnosis RGPD within 10 working days
The measures of Article 32 verified in its infrastructure.
Sources
- EUR-Lex — Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 33 and 34
- CNPD — Data breach or data breach
- CNPD — Form for notification of personal data breach
![mun[it] logo, a digital marketing agency — a DataRoad client](https://www.dataroad.pt/wp-content/uploads/2026/09/logo-cliente-munit.png){kind=logo}
