Technical and organisational measures
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Technical and organisational measures - The security controls (technical, e.g. encryption; organisational, e.g. policies/teams) that protect personal data.
In the CIPP/E body of knowledge, Technical and organisational measures comes up under Ch 11.2 - Controller responsibility; Ch 6.7 - Integrity and confidentiality.
Technical and organisational measures in context
- Crucially, the meaning of ==appropriate technical and organisational measures== is unusually well-defined because it draws on an established body of security best practice and standards. (Background - why security is an A-list principle)
- Article 5(1)(f) sets the [[security principle]] ('integrity and confidentiality'); [[Article 32]] expands on it, requiring ==appropriate technical and organisational measures== that fit the level of risk. (Security principle and the risk-based approach (Article 32))
- [[Article 24]] codifies this - controllers must implement ==appropriate technical and organisational measures== and review/update them, scaled to the risk. (Responsibility of the controller)
Where Technical and organisational measures is covered in the CIPP/E study notes
Related terms
- Integrity and confidentiality
- Pseudonymisation
- Article 5
- Article 5(2)
- Article 24
- Controller
Test yourself on Technical and organisational measures
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.