Compliance beyond good practice: What regulators see as ‘appropriate’ security measures

Abstract

This paper explores enforcement trends regarding cyber security under the General Data Protection Regulation (GDPR) and other European laws. Drawing on decisions by data protection authorities in the UK, Sweden, Spain, Belgium and Greece, the paper analyses how fines are not imposed for cyber security breaches alone but for the broader structural failures and lapses in compliance that they can reveal. This underlines the fact that cyber security is not a fixed state but a continuous process of risk assessment, mitigation and documentation. Leveraging case studies, the paper examines requirements from regulators, such as documented risk assessments, timely patching and software upgrades, regular employee training, incident response planning, effective user authentication and system logging. One notable lesson is the importance of organisations providing evidence of why certain security measures were either taken or omitted, especially when deviating from best practice. The paper stresses the importance of ensuring that written rules are not only well designed but effectively implemented and monitored, as well as the growing emphasis on proportionality in enforcement. It stresses the broader implications of GDPR enforcement decisions regarding cyber security, as the legislative standard used in the GDPR, ‘appropriate technical and organisational measures’, also appears in identical or similar form in other laws, such as the Digital Services Act or the NIS2 Directive. The paper encourages organisations to treat cyber security as an evolving process, to stay up to date and to document decisions, but also to defend well-founded choices even in the face of regulatory scrutiny. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.