GDPR in IT Practice: Technical Requirements for Businesses

GDPR IT measures are the part of the regulation that legal departments often leave to IT, while IT waits for instructions from legal. The result is a gap. Below is a practical list of what must be technically arranged and how to prove it.

TL;DR — Key Highlights

• GDPR requires 'appropriate technical and organizational measures' — you prove appropriateness with a risk assessment.
• Encryption, access control, logs, and backups are the minimum.
• The deadline for reporting a breach is 72 hours — you need a process, not improvisation.
• Data Processing Agreements (DPAs) with processors (IT and cloud providers) are mandatory.

Expected Technical Measures

The supervisory authority does not prescribe specific products, but expects measures to be proportionate to the risk. In practice, this means: disk encryption on laptops, MFA for accessing systems with personal data, separate rights based on the principle of least privilege, access logs, and regularly verified backups.

In addition, you need a Record of Processing Activities (ROPA) that matches the actual state of your systems. If the record states that video surveillance footage is kept for 30 days, it must be configured that way.

Why IT Compliance is Often the Weakest Link

Documentation is usually in order, but technical implementation lags behind.

• Shared accounts (info@, admin) make it impossible to track access to personal data.
• Data in Excel files on desktops is not captured in any record.
• Absence of a deletion policy means storage without a legal basis.
• External contractors without a Data Processing Agreement are a violation in themselves.

How to Get Started — Recommended Process

1. Inventory where personal data actually resides — including shared folders and email clients.
2. Implement named accounts and MFA and eliminate shared logins.
3. Set retention periods and automatic deletion where possible.
4. Enable access logs for sensitive folders and systems.
5. Organize Data Processing Agreements with all IT vendors.
6. Document the breach reporting process with contacts and the 72-hour deadline.

Risks and Appropriate Measures

Most Common Mistakes

The most common mistake is copying policies from the internet without verifying if the system actually implements them. The supervisory authority checks the actual state, not just the document.

Another mistake is the forgotten right to erasure: if data exists in a backup, this must be described in the policy, along with the period after which it disappears from there as well.

How VitalIT Can Help

At VitalIT, we align technical measures with your processing records, organize access and logs, and prepare documentation. Check our cybersecurity and IT consulting services.

Read also: NIS2 Directive: What Slovenian Companies Need to Arrange.

Frequently Asked Questions (FAQ)

Does GDPR require encryption?

Not explicitly, but it mentions it as an example of an appropriate measure. For portable devices, it is expected in practice.

How long can we keep employee data?

According to the period determined by sectoral legislation; without a legal basis, they must be deleted.

Is Microsoft 365 GDPR compliant?

The platform provides appropriate tools and contractual terms, but configuration and usage are your responsibility.

Who must have a DPO?

Public authorities and companies with large-scale systematic processing or processing of special categories of data.

What counts as a breach?

Any accidental or unlawful loss, alteration, or disclosure of personal data — even a lost USB stick.