Technical and Organisational Measures (TOMs)

Technical and organisational measures (TOMs) are the safeguards an organisation puts in place to protect personal data, as required by Article 32 GDPR. Technical measures include encryption, access controls and backups; organisational measures include roles, training, policies and a data retention concept.

What are technical and organisational measures?

Technical and organisational measures, usually shortened to TOMs, are the concrete safeguards a business uses to keep personal data secure. Article 32 of the GDPR (and of the UK GDPR) requires every controller and every processor to implement measures that ensure a level of security appropriate to the risk. The law does not hand you a fixed checklist. It asks you to weigh the state of the art, the cost of implementation, and the nature, scope and purpose of the processing against the risk to the people whose data you hold.

Article 32 names a few examples outright: pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data quickly after an incident, and a process for regularly testing and evaluating whether the measures actually work.

Technical measures

  • Encryption of data in transit (TLS) and at rest
  • Access control: individual logins, strong passwords, two-factor authentication
  • Role-based permissions, so each person only sees the data they need
  • Backups and a tested restore process
  • Logging of who accessed or changed what
  • Firewalls, patching and malware protection

Organisational measures

  • Clear responsibilities and a named data protection contact
  • Staff training and confidentiality commitments
  • Written policies for access, passwords and devices
  • A data retention policy that defines when data is deleted
  • An incident response plan for data breaches
  • Careful selection and contracts with processors, backed by a data processing agreement (DPA)

Why TOMs matter for small and mid-sized businesses

Many owners assume TOMs are a topic for corporations with a security team. They are not. The obligation applies to a 10-person agency in the same way it applies to a bank; only the appropriate level differs. Three reasons make TOMs practical rather than theoretical:

  • Fines and enforcement: an inadequate level of security is a breach of Article 32 in its own right. Under Article 83, fines in this category can reach up to €10 million or 2% of worldwide annual turnover, whichever is higher.
  • Proof after a breach: if a laptop is stolen or an account is compromised, the supervisory authority will ask which measures were in place. Documented TOMs are your answer.
  • Part of every DPA: when you use a processor such as a cloud tool or a messaging platform, Article 28 requires the contract to cover security measures. Your service providers’ TOMs become part of your own compliance picture.

Example: an accountancy practice in Leeds

Picture an accountancy practice in Leeds with 12 staff. Client files contain bank details, payslips and tax records. The practice has already encrypted every laptop, runs daily encrypted backups to a UK data centre and gives each employee an individual login with two-factor authentication.

Then clients start asking for WhatsApp. Until now, two partners answered questions from their personal phones. That is a gap: no central access control, no record of who said what, and client data sitting on private devices. When the practice chooses a messaging platform, it checks the provider’s TOMs just as it would check any other processor: where is data hosted, is it encrypted, can access be restricted per role, and is a DPA available? The result is a single shared inbox, documented as one more entry in the practice’s security concept.

TOMs at SendSeven

If you use SendSeven for customer messaging, SendSeven acts as your processor, and its measures form part of your documentation:

  • Hosted in the EU (Frankfurt, Google Cloud). Platform and database run in European data centres; see data residency.
  • Encrypted in transit (TLS) and at rest.
  • Roles and permissions: role-based access control with custom roles, so agents only see what they need.
  • DPA under Article 28, so the processing relationship is documented.
  • Optional AI: off by default, runs in the EU, and your data is never used for model training.

One note on the channels: when you send through WhatsApp, Instagram or Messenger, Meta processes those messages under its own terms, partly outside the EU. Your TOMs and records should reflect that. More on the overall picture in GDPR-compliant messaging. Plans start at €49/month (Basic); details on the pricing page.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.