For a CTO, GDPR is a set of architecture constraints with legal weight. Article 32 requires security appropriate to the risk, Article 28 governs every vendor that touches personal data, Article 33 sets a 72 hour breach clock, and Article 25 asks for protection by design. Decide those four deliberately.
Which GDPR articles land on a CTO's desk?
Four do most of the work. Article 25 asks the controller to build in data protection by design and by default. Article 28 sets rules for processors, meaning vendors that handle data on your behalf. Article 32 requires technical and organisational measures that fit the risk. Article 33 requires breach notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware.
The text of Article 32 names examples: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access after an incident, and a process for regularly testing and evaluating the measures. Treat that list as a design review agenda, not as a minimum checklist, because the standard is "appropriate to the risk".
What does "by design and by default" mean in a codebase?
Article 25 refers to the state of the art, the cost of implementation and the risks of the processing. In practice that becomes questions you can answer in a pull request. Does this new field need to exist? Is it collected by default or only when the user opts in? Who can read it? How long does it live?
Constructed example: a product team adds a "company size" and "job title" field to sign up, and the analytics pipeline copies the whole user record into a warehouse. Nobody asked whether analysts need the job title. A default of "copy only what the report uses" would have kept it out. That is Article 25 in one sprint.
How do processor contracts change vendor choices?
Article 28 says the controller may use only processors that give sufficient guarantees, and that processing is governed by a binding contract setting out subject matter, duration, nature, purpose, data types and the parties' obligations. The processor may not engage another processor without prior written authorisation, specific or general. For general authorisation the processor must tell you about intended changes so you can object.
For a CTO the consequence is a living vendor register. Every SaaS tool, every AI API, every managed database that sees personal data needs a contract on file and a subprocessor change process that someone actually reads.
What should the 72 hour clock do to your incident process?
Article 33 starts the clock when the controller becomes aware of a breach, unless the breach is unlikely to result in a risk to people. Processors must notify the controller without undue delay after becoming aware. So your incident runbook needs a decision point early: is personal data involved, and who decides whether the risk threshold is met? That person must be reachable at 3 a.m.
How big are the penalties?
Article 83 sets two tiers. Infringements of the basic principles, data subject rights and transfer rules can bring fines up to 20 million euros or, for an undertaking, up to 4 percent of total worldwide annual turnover of the preceding year, whichever is higher. Breaches of obligations such as Articles 25 to 39 can bring up to 10 million euros or 2 percent. Supervisory authorities weigh many factors, so the numbers are ceilings, not prices.
What to do
- Write a data map: systems, personal data categories, purposes, retention, location.
- Add a privacy check to design review that asks the Article 25 questions.
- Build a vendor register with the Article 28 contract, location and subprocessor list for each processor.
- Write the Article 32 measures down per system, including who tests them and how often.
- Put the 72 hour decision point in the incident runbook, with named deputies.
- Rehearse once a year with a constructed incident that involves a vendor.
Quick check
Does GDPR require encryption?
Article 32 lists pseudonymisation and encryption as examples of measures to consider, as appropriate to the risk. It does not make one technology mandatory for every case.
When does the 72 hours start?
Under Article 33 it starts when the controller becomes aware of the personal data breach, and notification is required unless the breach is unlikely to result in a risk to individuals.
Sources
Last reviewed: 18 October 2026.
