01
Safeguarding availability
Defender, Guardian, SentinelUptime monitoring and website and domain protection keep your systems reachable and operational. Article 32 explicitly requires the ability to restore availability after an incident.
GDPR security for companies: what does the law require of you?
The General Data Protection Regulation (GDPR) applies to every company that processes personal data. That is almost every business: anyone who keeps a customer list, sends invoices or employs people processes personal data.
The law requires you to secure that data adequately. Not in a way you consider appropriate yourself, but demonstrably appropriate. A supervisory authority can check whether you can prove it. And in the event of a data breach you are obliged to report it within 72 hours.
GDPR
What does the GDPR require when it comes to security?
Article 32 of the GDPR is the heart of the security obligation. It requires you to take “appropriate technical and organisational measures” to protect personal data, taking into account the risk a breach poses to the people involved.
The GDPR names four concrete examples of what may be appropriate:
- Pseudonymisation and encryption of personal data
- The ability to ensure the confidentiality, integrity and availability of systems
- The ability to restore access to personal data in good time after an incident
- Regular testing and evaluation of the security measures
Article 33 obliges you to report a data breach to the supervisory authority within 72 hours, provided the breach poses a risk to the people involved.
The risks
What are the risks if you do not comply?
- A fine from the supervisory authority: up to 20 million euros or 4% of worldwide annual turnover
- Damages claims from people whose data leaked
- A duty to disclose the breach, with reputation damage as a result
- An order from the regulator to stop processing activities
Our contribution
How does Orange Warriors contribute to GDPR compliance?
We deliver the technical measures that give article 32 its concrete shape. All three of our packages contribute to GDPR compliance, each at a different level.
02
Encryption and access control
All packagesSSL/TLS certificate monitoring ensures data traffic is encrypted. The password manager provides strong, unique passwords per account and limits access to authorised users.
03
Early detection of leaks
All packagesMonitoring for leaked passwords tells you immediately when your staff logins appear on the dark web. That is the early detection that keeps a leak from escalating.
04
Vulnerability management and testing
Guardian, SentinelArticle 32 requires regular testing of security measures. Our automated vulnerability scans (annual in Guardian, quarterly in Sentinel) provide the evidence that you take that obligation seriously.
05
Staff awareness
SentinelThe GDPR also requires organisational measures. Security awareness training helps staff recognise phishing and social manipulation, reducing the human risk of a breach.
Please note
Orange Warriors delivers technical security measures that contribute to compliance. We do not issue certification and we are not a legal adviser. Whether you fully meet a guideline also depends on organisational measures, policy and documentation that fall outside our services.
Official GDPR text in English (EUR-Lex)
FAQ
Frequently asked questions about the GDPR and security
Does the GDPR also apply to small companies?
Yes. The GDPR makes no exception based on company size. Every company that processes personal data falls under the law.
Do I have to appoint a data protection officer?
That is only mandatory for public authorities, companies processing special categories of personal data on a large scale, or companies systematically monitoring people on a large scale. For most smaller companies the obligation does not apply.
What counts as "appropriate" security?
The GDPR gives no exact standards. Appropriate means the measure is proportionate to the risk. We help you map that risk and choose the right measures.
Does Orange Warriors provide a GDPR statement or certification?
No. We deliver technical security measures that contribute to GDPR compliance. Whether you fully comply also depends on policy, processing agreements and internal procedures. We are not a legal adviser.
Free scan
See which package fits your GDPR obligations
All three of our packages contribute to article 32. In a free scan we work out together which level fits your company.