Article 32 of the GDPR calls for “appropriate technical and organisational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP? This article is the practical follow-up to our guide to the Data Protection Impact Assessment for the cloud.
From Requirement to Technology
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use — the same shared-responsibility logic that applies to BSI C5.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymisation and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorised persons.
- Azure — Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
- Azure — Encryption in Transit: Enforce TLS 1.2+ for all connections.
- Azure — Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible; Managed HSM for HYOK).
- GCP — Encryption at Rest: Enabled by default for all services.
- GCP — Encryption in Transit: Default for all connections.
- GCP — Key Management: Cloud Key Management Service (Cloud KMS), also with BYOK and External Key Manager options.
For the choice between BYOK and HYOK see Cloud Key Management: BYOK vs. HYOK.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorised persons can access data and that it cannot be altered unnoticed.
- Azure — Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
- Azure — Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
- GCP — Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
- GCP — Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
- Azure — High Availability: Use of Availability Zones and Availability Sets.
- Azure — Scalability: Virtual Machine Scale Sets, App Service Plans.
- GCP — High Availability: Distribution of instances across multiple zones.
- GCP — Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
- Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
- GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
- Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
- GCP: Security Command Center for centralised vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
| TOM Category | Measure | Implemented? |
| Encryption | Data-at-Rest & Data-in-Transit fully active | ☐ |
| Access | MFA for all administrative and privileged accounts | ☐ |
| Network | Strict segmentation and firewall rules | ☐ |
| Backup | Regular, tested backups of all critical systems | ☐ |
| Monitoring | Continuous monitoring of security configuration | ☐ |
| Patching | Timely application of security updates | ☐ |
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5, ISO 27001 or NIS2.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure, AWS and GCP to meet the requirements for technical and organisational measures — securely, documented, and auditable. Our managed cloud operations include the continuous monitoring and optimisation of your TOMs, so that your data protection level remains high even as threats and technologies change.
Implement data protection technically. See NIS2 & Cloud Security Beratung (German) or contact us.