What is the GDPR?

The GDPR in plain English

When you check your coat at the theater, you expect three things: the coat is kept safe, nobody else wears it, and you get it back when you ask. It is much the same with the data that customers, employees, or business partners entrust to a company. The General Data Protection Regulation – GDPR for short, known in German as the DSGVO – sets out how companies must handle this data.

The GDPR has applied throughout the EU since May 25, 2018; its official name is Regulation (EU) 2016/679. It protects personal data, meaning any information that can be linked to a specific person: name, address, email address, customer number, IP address, or health data. In Germany, the regulation is supplemented by the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

The GDPR affects virtually every company – from a small contractor with a customer list to a large corporation. It is particularly important for IT security because it explicitly requires appropriate safeguards.

What the GDPR requires

The regulation is extensive. In practice, these building blocks matter most:

1. Principles (Art. 5): Data may only be processed lawfully, for specified purposes, and to the extent necessary. It must be accurate, may not be stored longer than necessary, and must be protected against unauthorized access, loss, and destruction.
2. Legal basis (Art. 6): Every processing operation requires a legal basis, such as consent, a contract, or a legal obligation.
3. Data subject rights: Individuals can, among other things, request access to their data and have it corrected or erased.
4. Service providers (Art. 28): If you have data processed on your behalf, you need a data processing agreement (DPA), known in German as an Auftragsverarbeitungsvertrag (AVV).
5. Security of processing (Art. 32): Companies must implement appropriate technical and organizational measures (TOMs).
6. Data breaches (Art. 33 and 34): If the security of personal data is breached – for example, by a hacker attack – the breach must be reported to the data protection supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The only exception is when the breach is unlikely to result in a risk to the individuals concerned. If the risk is high, the affected individuals themselves must also be informed.
7. Accountability (Art. 5(2)): Companies must be able to demonstrate that they comply with the rules.

Art. 32 requires measures that are appropriate to the risk and take the state of the art into account. Among other things, it explicitly mentions:

• Pseudonymization (for example, replacing names with ID numbers) and encryption
• The ongoing confidentiality, integrity, availability, and resilience of systems
• The ability to restore data quickly after an incident, for example from backups
• A process for regularly testing, assessing, and evaluating the effectiveness of the measures

The last point is crucial: it is not enough to introduce safeguards. Their effectiveness must be reviewed regularly.

A practical example

Here’s a typical scenario: A medical practice with several locations uses remote access so that practice staff can work with the practice management software while on the go. An attacker exploits a known but unpatched vulnerability in this remote access and copies patient data.

The practice must report the incident to the data protection supervisory authority. Because health data is particularly sensitive and there is a high risk to the individuals concerned, it must also inform the affected patients. The authority then asks which safeguards were in place and how their effectiveness was reviewed. A regular penetration test with documented remediation of the findings might have uncovered the vulnerability in time – and would have been important evidence.

Why does this matter for businesses?

Violations can be costly. For breaches of the security obligations under Art. 32, the GDPR provides for fines of up to €10 million or 2 percent of worldwide annual turnover. For violations of the processing principles or of data subject rights, fines of up to €20 million or 4 percent apply. These principles also include the confidentiality and integrity of data. In each case, whichever amount is higher applies. On top of that, affected individuals may claim damages, including for non-material harm (Art. 82).

The loss of trust is at least as serious. Customers and partners want to be sure that their data is in good hands.

The GDPR doesn’t prescribe specific products or testing methods. It requires that your measures match the risk – and that you can prove it. Penetration tests are a recognized way to verify the effectiveness of technical measures in a traceable manner. If a testing team gains access to personal data during the test, a DPA may also be required for the test itself.

What businesses should do now

• Get an overview: Record which personal data you process and where, for example in your record of processing activities (Art. 30).
• Assess risks: Determine how sensitive the data is and which measures are appropriate.
• Document your TOMs: Put your technical and organizational measures in writing and keep them up to date.
• Test effectiveness: Test your safeguards regularly, for example with penetration tests and vulnerability assessments.
• Involve service providers: Conclude DPAs and pay attention to the security of your processors.
• Prepare for data breaches: Define who assesses an incident and reports it on time.
• Bring in experts: Involve your data protection officer early on, if you have one.

Note: This article provides a general overview and does not constitute legal advice.

How Rootsektor can help

A penetration test shows whether your technical measures can withstand a realistic attack and helps you document the regular testing required by Art. 32 GDPR in a traceable way. As a Germany-based security company, we test web applications, networks, cloud environments, and more – you’ll find an overview under Penetration Testing. You’ll receive a report with an executive summary and concrete remediation recommendations, plus a test certificate for customers, partners, and auditors. After scoping, we’ll send you a fixed-price quote within 24 hours (on business days) – you can request it via our Pentest Quote page.