Art. 32 DSGVO (Sicherheit der Verarbeitung)

Anyone who processes personal data must protect it – even when the devices it resides on were retired long ago. The central provision is Art. 32 GDPR. This glossary entry explains what the article requires, what that means for old laptops, servers and hard drives and which documentation you need in an audit.

What does Art. 32 GDPR say?

Art. 32 belongs to Chapter IV of the General Data Protection Regulation (GDPR). This chapter governs the obligations of controllers and processors. The controller is whoever decides on the purpose and means of processing – usually your company. A processor is a service provider that processes data on your behalf. The article has four paragraphs:

• Paragraph 1: Obligation to take appropriate technical and organizational measures. To be weighed are the state of the art, the costs, the nature, scope, context and purposes of processing as well as the likelihood and severity of the risk. Examples named are pseudonymization and encryption, the ongoing assurance of confidentiality, integrity, availability and resilience of systems, the rapid restoration after an incident and a process for regularly testing effectiveness.
• Paragraph 2: When assessing the level of protection, the risks from destruction, loss, alteration, unauthorized disclosure or unauthorized access count in particular – whether accidental or unlawful.
• Paragraph 3: Approved codes of conduct (Art. 40) or certification mechanisms (Art. 42) can serve as a factor to demonstrate compliance.
• Paragraph 4: Persons who have access to personal data may process it only on instruction.

The article does not prescribe fixed measures. It requires a level of protection appropriate to the risk. That makes it flexible, but also demanding: you must be able to justify why your measures are appropriate.

What does Art. 32 GDPR mean for retired IT?

A retired device is no special case for the GDPR. As long as personal data resides on a hard drive, an SSD or a smartphone, processing takes place. Storing and erasing also count as processing (Art. 4 No. 2 GDPR). Art. 32 therefore applies until the moment when the data demonstrably no longer exists.

The risks from paragraph 2 in particular occur frequently during retirement: devices get lost in transport, stand unsecured in storage or are passed on without erasure. Simple formatting is not enough, because the data can often be recovered. This phenomenon is called Data remanence. Appropriate are tested erasure methods or physical destruction that match the protection need. How to determine the protection need is explained in the entry Protection requirement assessment.

If you commission a service provider, your company remains responsible. You must select it carefully and bind it contractually, as a rule through a data processing agreement under Art. 28 GDPR. In it, the service provider also commits to the measures under Art. 32.

Obligations and documentation when retiring devices

The table assigns typical measures to the risks under Art. 32. It is a guide, not an exhaustive list.

Risk or protection goal	Typical measure	Proof
Unauthorized access on the premises	Lockable collection containers, locked storage room	Room and key concept
Loss in transport	Sealed containers, direct run, vehicle tracking	Handover protocol with seal numbers
Incomplete handover	Reconciliation of serial numbers at handover and goods receipt	Inventory list, receipt protocol
Disclosure after handover	Tested erasure or destruction according to protection need	Certificate of destruction or disposal per serial number
Acting only on instruction (para. 4)	Obligating employees to confidentiality	Commitment declarations, training records
Effectiveness (para. 1 point (d))	Regular review of processes and service providers	Audit reports, inspection records

You need the documentation not only for the supervisory authority. Under the Accountability (Art. 5(2) GDPR) you must be able to demonstrate compliance at any time. Together, the documentation forms the Chain of custody, that is, the seamless chain of custody of every device.

Typical mistakes

• Old devices pile up openly in corridors, basements or meeting rooms.
• Hard drives are only formatted, or the operating system is reinstalled.
• A service provider is commissioned without a data processing agreement.
• Documentation states only quantity or weight, but no serial numbers.
• Data carriers in printers, copiers, USB sticks or company phones are forgotten.
• The processes are never reviewed, although paragraph 1 requires exactly that.

Violations of Art. 32 can be punished under Art. 83(4) GDPR with fines of up to 10 million euros or up to 2% of worldwide annual turnover, whichever is higher. If data is lost, a reportable Data breach under Art. 33 GDPR may also exist.

Practical example: 60 laptops and a server

A simplified example shows how the requirements can be translated into a process. A company replaces 60 laptops and a file server. All devices contain personnel and customer data.

1. Define protection requirements: The data have a high protection need. It is determined: functional data carriers are erased in a certified manner, defective ones destroyed according to DIN 66399.
2. Bind the service provider: A data processing agreement describing the measures is concluded with the service provider.
3. Record and secure: IT creates a list of all serial numbers. Until pickup, the devices are kept in a locked room.
4. Hand over: The containers are sealed. The handover protocol states quantity, seal numbers and both signatures.
5. Reconcile and erase: At goods receipt, the serial numbers are reconciled with the list. Erasure or destruction follows.
6. File: The certificates are assigned to the inventory list and archived together with the contract.

If the supervisory authority asks later, the company can show for each serial number what happened to it.

Art. 32 GDPR at Second IT

Second IT collects retired IT with its own secure logistics: direct runs without interim storage, GPS monitoring, tamper-proof sealing and insured transport. At goods receipt, all devices are checked for storage media and registered by serial number. The site is protected by access control and video surveillance. Employees are bound to data secrecy; on request, non-disclosure agreements are concluded. Erasure is carried out with Blancco, with a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house according to DIN 66399. Second IT is certified to ISO/IEC 27001. More on data security in the processing chain.

Distinction from related terms

Art. 32 describes the goal, namely an appropriate level of protection. The concrete steps toward it are called Technical and organizational measures (TOMs). Art. 25 GDPR (data protection by design) starts earlier, at the planning of systems. Art. 5(1)(f) GDPR names integrity and confidentiality as a principle; Art. 32 makes it concrete. A certification under ISO/IEC 27001 is not a certification mechanism within the meaning of Art. 42 GDPR. It does show, however, that a company manages information security systematically.

Which GDPR obligations count in an audit when disposing of devices is explained in our guide Disposing of data carriers under the GDPR. Why old hard drives are an underestimated risk, you can read in Data protection for old hard drives. This entry does not replace legal advice.

Frequently asked questions about Art. 32 GDPR

Does Art. 32 GDPR also apply to devices that are no longer used?

Yes. As long as personal data is stored on a device, processing takes place. The duty of protection ends only when the data has demonstrably been erased or the data carrier destroyed.

Does Art. 32 GDPR prescribe a specific erasure method?

No. The yardstick is the state of the art and the risk. Recognized standards such as NIST SP 800-88 for erasure and DIN 66399 for physical destruction serve as guidance. What matters is that you can justify and document your choice.

Who is responsible when a service provider takes over the erasure?

Your company remains the controller. The service provider, as processor, is itself bound by Art. 32. Regulate the measures in a data processing agreement and have the performance documented for each device.

Which documentation should I keep?

Typical are the inventory list with serial numbers, the handover protocol, erasure or destruction certificates per serial number, the data processing agreement and audit reports of the service provider. How long you retain these documents is best set in your erasure policy.

What are the consequences of violating Art. 32 GDPR?

Art. 83(4) GDPR provides for fines of up to 10 million euros or up to 2% of worldwide annual turnover, whichever is higher. In addition there are possible claims for damages by data subjects under Art. 82 GDPR.