A library encrypts staff laptops but leaves shared network drives open to every staff login with no further access restrictions. Leadership claims encryption alone proves GDPR security compliance. What is the best assessment?
Select an answer to reveal the explanation.
Short Explanation
Encrypting the laptop while leaving the shared drive wide open is like locking the front door and leaving the garage up. GDPR wants measures that fit the risk—not one shiny control as a participation trophy. Layered, appropriate protection beats a single checkbox.
Full Explanation
Appropriate technical and organisational measures must be risk-based and layered; encryption of staff laptops alone does not automatically demonstrate GDPR security compliance when shared network drives remain open to every staff login. Article 32 evaluates state of the art, costs, and risks of processing across the environment. Laptop encryption does not always satisfy Article 32 regardless of shared-drive exposure. Shared drives do not need no access controls merely because some endpoints use full-disk encryption. GDPR security is not met whenever a single technical control appears somewhere in the organisation. Exam caveat: one control ≠ programme adequacy; look for layered, risk-based TOMs. Operational check: remediate unrestricted shared drives with least-privilege access, logging, and classification before claiming encryption proves Article 32 compliance in a library or civic office estate. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.