A council measures ‘security’ solely by counting firewalls and ignores staff training, policies, and procedures that govern how personal data is handled. What does GDPR TOMs thinking require?
Select an answer to reveal the explanation.
Short Explanation
Firewalls without trained people and clear rules are like a vault with the combination taped to the door. GDPR talks about technical and organisational measures for a reason—both halves matter. Policies and training are part of the security story.
Full Explanation
Organisational measures such as policies, training, and procedures form part of appropriate technical and organisational measures alongside technical controls under Article 32. Councils that measure “security” solely by counting firewalls ignore human-factor and process risks the legal standard expressly includes. Only network firewalls do not exhaust TOMs. Training is not optional colour for audits. Organisational measures are not limited to special-category data. Exam caveat: TOMs = technical + organisational; technology-only answers fail. Operational check: pair perimeter controls with mandatory privacy/security training, acceptable-use policies, and procedures for access reviews and incident escalation in the civic security programme. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis. Confirm the analysis against the GDPR text and competent supervisory guidance before relying on it in production systems.