TOM and Data Security: Implementing Technical and Organisational Measures Correctly

Anyone who processes customers' personal data must protect it with appropriate technical and organisational measures (TOM) and must also be able to prove their implementation in a dispute. This applies to the online shop just as much as to the tax advisory firm or the IT service provider.

In brief: TOM are the technical and organisational measures with which companies protect personal data against loss, misuse and unauthorised access. All controllers and processors who process customer data are affected, regardless of company size. If appropriate TOM are missing, substantial fines are possible in the event of a data breach.

Who is subject to the TOM obligation?

Both controllers and processors who process customers' personal data are affected, from the sole proprietorship to the large corporation.

The obligation to implement appropriate TOM arises from Art. 32 GDPR and applies regardless of company size or industry, from the sole trader with a handful of customer records to the mid-sized business with its own IT department. Anyone who uses a processor, such as a cloud provider, an accounting firm or IT support, must check its TOM before engaging it and anchor the measures in the data processing agreement (AVV, Auftragsverarbeitungsvertrag). Conversely, processors must disclose to their clients which protective measures they use themselves.

Even if you do not process particularly sensitive data such as health or payment data, you are subject to the obligation: ordinary customer data such as name, address or email address already falls within the protective scope of the GDPR and must be adequately secured.

What do you need to do in practice?

You must implement risk-based measures in line with the state of the art that match the protection needs of the data processed.

Technical measures include, among others, access controls, encryption of data in transit and at rest, and a functioning backup concept. Organisationally, this above all means: clear responsibilities, regulated processes for granting and withdrawing access rights, and written documentation that can be presented in an emergency, for example during an inspection by the supervisory authority. A tool such as Company Audit shows which of these obligations apply to your company in detail.

The risk-based approach is important: the more sensitive the data processed and the greater the potential damage in the event of an incident, the higher the protective measures must be. A small business with a simple customer database needs different measures than a company that processes health or financial data.

Documented TOM in five steps

Implementation can be structured in five comprehensible steps that build on one another.

1. Assess the protection needs of the customer data processed (normal/high/very high).
2. Grant access rights on a need-to-know basis and review them regularly.
3. Use encryption for the transmission and storage of sensitive data.
4. Set up and test a backup and recovery concept.
5. Document the measures implemented in writing (TOM document).

This order is chosen deliberately: only once the protection needs are known can access rights, encryption and backup strategy be sensibly sized. The final documentation makes the decisions taken traceable, including for new employees or external auditors.

How often do TOM have to be reviewed?

TOM are not a one-off project but must be continuously adapted to new risks.

Review access rights regularly and update the measures as soon as systems, processes, headcount or the threat landscape change, for example when introducing new software, switching cloud provider or after a security-relevant incident. In practice, the TOM document is often requested directly as an annex to the data processing agreement (AVV); both documents should therefore be maintained together and updated in sync when changes occur.

What are the consequences of a violation?

Missing or inadequate TOM are among the most common reasons for GDPR fines, especially when they come to light in connection with a data breach.

Under Art. 32 GDPR, inadequate security measures can lead to fines of up to 10 million euros or 2 % of worldwide annual turnover, above all when it is established after a data breach that appropriate protective measures were lacking.

In addition to the fine, a data breach also entails reporting obligations towards the supervisory authority and, where applicable, the data subjects, as well as damage to trust and reputation that is often harder to quantify than the fine itself.

Frequently asked questions

What counts as technical measures?

These include, for example, access controls such as password protection and authorisation concepts, encryption of data in transit and at rest, and a tested backup and recovery concept with which data can be reliably restored after an incident.

What counts as organisational measures?

These include, for example, granting access rights on a need-to-know basis, clear responsibilities within the company and written documentation of all measures in the TOM document, so that the decisions taken are traceable at any time.

Does the TOM obligation also apply to small businesses?

Yes, Art. 32 GDPR applies regardless of company size to all controllers and processors who process personal data, including sole traders and small businesses without their own IT department.

How are TOM and the data processing agreement related?

In practice, the TOM document is often requested directly as an annex to the AVV, which is why both documents should be maintained together and reconciled with every update.

What is a simple first step?

Introducing two-factor authentication for core systems is a simple and effective first step towards better data security, and can usually be implemented without great effort.

Source: Art. 32 GDPR. This article is general information and does not replace legal advice in an individual case. As of: July 2026.