A security incident investigation shows personal data processing lacked basic integrity controls and access discipline. How does that finding map to GDPR processing principles?
Select an answer to reveal the explanation.
Short Explanation
When an incident reveals that nobody locked the doors or checked who could edit files, you are staring at the integrity and confidentiality principle in the wild. That principle is why appropriate security measures are not optional extras. Weak TOMs culture shows up as principle failure, not just ‘IT bad luck.’
Full Explanation
The integrity and confidentiality principle underpins the duty to implement appropriate technical and organisational measures to secure personal data. When a security incident investigation shows processing lacked basic integrity controls and access discipline, that finding maps directly to Article 5(1)(f) and to Article 32’s security obligations. Principles and security measures are connected: weak access control is not “only an IT issue” divorced from GDPR processing principles.
Integrity and confidentiality do not apply only to paper archives stored outside the EU. Security incidents remain related to Article 5 principles even if a privacy notice exists on a website. The right of access may matter for transparency after incidents but is not the only principle engaged by weak integrity controls that allowed unauthorised or careless processing.
Exam caveat: incident root causes often equal integrity/confidentiality principle failures on scenario questions. Operational check: remediate access control and integrity protections, update TOMs and records of processing, consider whether a personal-data breach notification analysis under Articles 33–34 is required, and document lessons learned. Civic incident reviews should explicitly link technical failures to principle breaches so leadership sees security as a privacy-law duty to residents, not only an uptime metric.