GDPR from an IT Perspective: Obligations You Must Not Overlook

The General Data Protection Regulation (GDPR, EU Regulation 2016/679) is a regulation that defines how companies must handle the personal data of EU citizens. For the IT department, this means specific technical and organizational measures that must be documented, implemented, and verified.

TL;DR — Key Points

• Encryption at rest and in transit is a key technical safeguard
• Every processing of personal data must be documented (records of processing activities)
• Breaches must be reported to the Information Commissioner within 72 hours
• Individual access rights (access, rectification, erasure) must be supported technically

Legal Basis in Slovenia

GDPR is applied alongside the Slovenian Personal Data Protection Act (ZVOP-2). The Information Commissioner (ip-rs.si) is the competent supervisory authority, also providing opinions and templates. Violations can be fined up to 4% of global turnover or 20 million EUR — whichever is higher.

Technical and Organizational Measures (TOM)

Article 32 of the GDPR requires measures appropriate to the risk. In practice, for IT this means:

1. Disk encryption on all devices (BitLocker, FileVault, LUKS)
2. TLS 1.2+ for all communications in transit
3. Access control — RBAC and the principle of least privilege
4. MFA for access to systems processing personal data
5. Segregated environments for development / testing — no real personal data (anonymization or synthetic data)
6. Regular backups and periodic recovery testing
7. Access logs (audit logs) with retention for at least 12 months

Records of Processing Activities

Every organization (except micro-enterprises in narrow cases) must maintain records of processing activities — a document describing what personal data you process, for what purpose, on what legal basis, who the users are, where it is stored, for how long, and who any processors are. This is not an IT document in the narrowest sense, but IT typically provides key information about systems and storage.

Subcontractors and Processors

Any external provider processing personal data on your behalf (e.g., Microsoft for M365, cloud providers, advertising platforms) is a processor. You must have a signed Data Processing Agreement (DPA) with each and a risk assessment regarding data transfers outside the EU. For Microsoft 365 and Azure, DPAs are included in the service terms.

Individual Access Rights

GDPR gives individuals the right to access, rectification, erasure, portability, and objection. IT must provide technical mechanisms for:

• Searching for individual data across all systems (CRM, ERP, email, ticketing, backup)
• Exporting in a machine-readable format (JSON, CSV)
• Permanent erasure from production databases and — after legal retention periods — also from backups
• Rectification of data with an audit trail of who, when, and why the record was changed

Breach Notification (72 Hours)

In the event of a breach (e.g., ransomware, successful phishing, lost unencrypted laptop), you must notify the Information Commissioner within 72 hours and — if the risk to individuals is high — also the affected persons. We recommend having an incident plan ready, including contact persons and message templates.

Intersection with ISO 27001

If you hold an ISO/IEC 27001 certificate, you have already covered many GDPR obligations — an Information Security Management System (ISMS) explicitly requires risk analysis, measures, and regular reviews. GDPR thus becomes a provably managed process, not just a legal issue. Read also our post on cybersecurity.

Practical Checklist for SMEs

1. Inventory of where all personal data is located (M365, ERP, CRM, marketing, HR)
2. Enable disk encryption on all devices
3. MFA for all accounts
4. Establish records of processing activities
5. Signed DPA with all processors
6. Establish a breach procedure (playbook + contact person)
7. Employee training (annually)
8. Internal audit once a year

Do we need a DPO (Data Protection Officer)?

Mandatory only if you are a public institution, or if core activities involve large-scale systematic monitoring or processing of special categories of data (health, biometric...). Otherwise, we recommend an internal data protection contact person.

Are we allowed to store backups in Azure outside the EU?

We recommend regions within the EU (West Europe, North Europe). For regions outside the EU, a regime of adequate safeguards applies (standard contractual clauses + technical protections).

What about old archives containing personal data we no longer need?

Define retention periods and implement phased deletion or anonymization. Keeping data 'just in case' contradicts the principle of storage limitation.

Do subcontractors need to have ISO 27001?

Not mandatory, but it is strong evidence of maturity. Alternatively, check written statements on TOM and perform an audit if necessary.