Technische und organisatorische Maßnahmen (TOM)

Anyone who processes personal data must protect it – even when a notebook or server is decommissioned. The GDPR calls the tool for this "technical and organizational measures", TOM for short. The term constantly appears in contracts, audits, and tenders. This glossary entry explains what is behind TOM, which measures count in IT decommissioning, and how you document them.

What are TOM in data protection?

The term comes from data protection law. Central is Art. 32 GDPR ("Security of processing"). Under it, controllers and processors must take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. Art. 24 and Art. 25 GDPR also refer to TOM, for example in data protection by design.

The GDPR does not prescribe a fixed list. It names examples: pseudonymization and encryption, the ongoing confidentiality, integrity, availability, and resilience of systems, rapid recovery after an incident, and a process for regularly reviewing the measures. Which measures are "appropriate" depends on the state of the art, the costs, the nature of the processing, and the risk to the data subjects.

Many companies still structure their TOM according to the eight control objectives of the former Federal Data Protection Act: entry, access, use, disclosure, input, order, availability, and separation. The structure is no longer mandatory but has proven its worth as an assessment framework.

What do TOM mean for decommissioned IT?

Decommissioned devices are an underestimated risk. Hard drives, SSDs, smartphones, and printers often still contain emails, customer data, or credentials. The obligation under Art. 32 GDPR does not end with a device's last working day. It applies until the data has been verifiably erased or the data carrier destroyed.

For decommissioning this means: you need measures for every stage of the route – from collection through storage and transport to erasure or destruction. If you commission a service provider, it must disclose its TOM. They are generally agreed as an annex to the data processing agreement . How that looks in an audit is shown by our guide Disposing of data carriers under the GDPR.

Typical TOM in IT decommissioning

The following table assigns common measures to the classic control objectives. It is an orientation, not an exhaustive list.

Control objective	Technical measure (example)	Organizational measure (example)
Entry	Access control system and video surveillance in the warehouse	Visitor policy, list of authorized persons
Access to systems and data	Hard drive encryption, locked accounts	Role and permission concept
Disclosure and transport	Sealed containers, GPS tracking	Handover record with serial numbers
Erasure and destruction	Certified erasure software, destruction in accordance with DIN 66399	Erasure concept, verification of results
Order control	Customer portal with status tracking	Data processing agreement, audits at the service provider
Proof	Signed erasure certificate for each device	Filing of the documentation for the accountability obligation

Technical and organizational measures often work together. An access control system is of little use if no one maintains the permissions. The Four-eyes principle is purely organizational but prevents errors that no technology catches.

How to recognize good TOM

• Specific rather than general: "Data is erased securely" is not enough. Good TOM name the method, software, and documentation.
• Aligned with the risk: The measures follow from a Protection requirement assessment. Health data needs more protection than a telephone directory.
• Up to date: Art. 32 GDPR requires regular review. A TOM document from five years ago is a warning sign.
• Verifiable: Certifications such as ISO/IEC 27001 or external audits show that an independent third party has reviewed the measures.

Typical mistakes

• The gap between workplace and service provider: Devices stand unlocked in the hallway or basement for weeks. For this phase there is often no measure at all.
• Copied TOM: A template from the internet rarely fits your own processing and is noticed in an audit.
• Bulk documentation: A confirmation of "200 hard drives erased" without serial numbers cannot be assigned to any device.
• Forgotten data carriers: Hard drives in printers, memory cards, or USB sticks in bags are missing from many concepts.

Practical example: TOM for a hardware replacement

A simplified example: a company replaces 150 notebooks and 20 monitors. The data protection officer sets the TOM for the project as follows:

1. Recording: IT creates a device list with serial numbers and marks devices with data carriers.
2. Intermediate storage: The old devices go into a lockable room to which only two people have access.
3. Handover: The service provider collects the devices in sealed containers. Both sides sign a handover record.
4. Transport: Direct trip without intermediate storage, vehicle tracked by GPS.
5. Deletion: Every hard drive is erased with certified software, defective data carriers are destroyed.
6. Evidence: The company receives an erasure or destruction certificate for each serial number and files it with the device list.

This creates an unbroken Chain of custody. Every step has a measure and a record. What else you should ask when selecting a service provider can be found in the checklist Choosing an ITAD provider.

Distinction from related terms

• Art. 32 GDPR is the legal basis. TOM are the concrete measures with which you fulfill this obligation.
• Data processing agreement (DPA): The agreement regulates the cooperation with a service provider. The service provider's TOM are usually an annex to it.
• ISMS: An information security management system steers all security measures in the company. TOM are the data-protection-related portion of it.

This entry explains terms and does not replace legal advice.

TOM at Second IT

Second IT processes decommissioned hardware at a site with access control and video surveillance. Only authorized employees have access to the processing areas. All employees are bound to data secrecy, and individual non-disclosure agreements (NDAs) come in addition. Collection is carried out with our own secure logistics: direct trip without intermediate storage, GPS monitoring, tamper-proof sealing, and insured transport. At goods receipt, all devices are checked for storage media and registered by serial number.

Erasure is done with Blancco, including hidden areas such as HPA and DCO, with a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399, certified for security level H-5. Second IT is certified to ISO/IEC 27001. More on the Data security at Second IT.

Frequently asked questions about TOM

Are TOM required by law?

Yes. Art. 32 GDPR obliges controllers and processors to take appropriate technical and organizational measures. The law does not prescribe a fixed list, however. The measures must fit the risk of the respective processing.

What is the difference between technical and organizational measures?

Technical measures work through technology, for example encryption, access control systems, or erasure software. Organizational measures regulate processes and responsibility, for example permission concepts, training, erasure deadlines, or the four-eyes principle.

Does an IT disposal company have to present its TOM?

If the service provider processes personal data on your behalf, a data processing agreement is generally required. In it, the provider describes its TOM, usually as an annex. Have the measures shown to you in concrete terms and ask for certificates and audit reports.

How often do TOM have to be reviewed?

The GDPR names no fixed deadline. It does require a process for regular review, assessment, and evaluation. An annual review is customary, and additionally whenever systems, service providers, or risks change.

Are erasure certificates part of the TOM?

The erasure itself is a measure, the certificate is its documentation. For the accountability obligation under Art. 5 GDPR you need both: a suitable method and a record for each device with serial number.