TOMs

GDPR Article 32 requires companies to implement a level of protection appropriate to the risk of the processing involved, without prescribing specific individual measures. Technical measures concern the systems themselves, such as encryption, access control, or backups; organisational measures concern processes and people, such as permission concepts, training, or clearly defined responsibilities. Together, both categories make up a company's TOMs.

In practice, TOMs are usually summarized in a document describing which specific measures apply to which systems, for example who has access to the NVR holding video footage, how passwords are managed, or how backups are secured. This document is often requested as an appendix to a Data Processing Agreement, because a controller needs to know how a provider protects its data. TOMs aren't a one-time document; they need to grow alongside new systems and new risks.

A common misunderstanding: TOMs aren't a fixed checklist that looks the same everywhere. Which measures are appropriate depends on the actual risk of the specific processing involved, and what's enough for a manufacturing business might fall short for a medical practice. Exactly how a company's own TOMs should be shaped in detail is ultimately a question the business works out with its own legal counsel.