Set by the law · GDPR Art. 32(1)
Security of processing
In plain English
Controllers and processors must protect personal data with technical and organisational measures suited to the risk, such as pseudonymisation, encryption and keeping systems confidential, intact, available and resilient.
The official text
the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
883 decisions on Fino cite Article 32 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.