If you are the first security hire, GDPR gives you three jobs: Article 32 security measures, the Article 33 breach response, and technical input to impact assessments. It does not make you the owner of lawful basis, consent wording or contracts. Knowing that line saves months of confusion.
What does GDPR ask of security directly?
Article 32 requires the controller and the processor to implement technical and organisational measures appropriate to the risk. The text gives examples: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, restoring availability and access after an incident, and a process for regularly testing and evaluating effectiveness. That last item is a standing duty. A penetration test once a year with no follow up is a weak answer to "regularly".
Where does the breach process sit?
Article 33 requires notification to the supervisory authority without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. The notification must describe the nature of the breach, categories and approximate numbers affected, a contact point, likely consequences and measures taken. Processors must tell the controller without undue delay. You will be the person who answers those questions, so build the evidence habit early.
Constructed example, with invented times. A support engineer exports a customer list to a personal drive at 09:10 Monday. Security learns of it at 14:00 Tuesday from an alert in a monitoring tool. The clock question is when the controller became aware, which your lawyer decides, but your timeline must show when each person knew what. Without logs of who opened what and when, the notification will be guesswork.
What is not yours?
Choosing a lawful basis under Article 6, writing consent text, setting retention periods and agreeing processor contracts under Article 28 belong to legal, privacy and the business owners of each data set. You supply the facts they need: what vendors can access, how data is protected at rest, who holds keys. Security also reviews whether a processor gives sufficient guarantees, which Article 28 expects of the controller.
How do you help with impact assessments?
Article 35 requires an impact assessment before processing likely to result in high risk, and it must describe measures to address the risks, including safeguards and security measures. The text names large scale special category data and systematic profiling with significant effects as examples. Your input is the risk and controls section: threat scenarios, access paths, detection and recovery.
Why does design matter to you?
Article 25 asks for data protection by design and by default. Security often sees the diagram first, so ask early whether a field needs to exist, who can read it by default and how long it lives. Deleting data you never needed is the cheapest control you will ever ship.
What does a good first week look like?
Start by reading, not building. Ask for the privacy notice, the vendor list and the last incident write up. Compare what the notice promises with what the systems do. The gaps you find in week one, such as a log that stores full email addresses for two years, are your first real findings, and they are far more persuasive to colleagues than a framework slide.
What to do in your first 90 days
- Get the data map from privacy or engineering. If none exists, build a rough one from the systems list.
- Write the Article 32 measures per system in plain words with an owner each.
- Draft the breach runbook with the Article 33 content fields as a template.
- Check that logs can answer who accessed what personal data, and when.
- Review how long logs themselves are kept, since they can contain personal data.
- Agree with legal who decides on notification and how fast they can be reached.
Quick check
Is the security team responsible for the lawful basis?
No. Lawful basis under Article 6 is a privacy and business decision. Security supplies facts about protection and access.
What must a breach notification include?
Article 33 lists the nature of the breach with categories and approximate numbers, a contact point, likely consequences and measures taken or proposed. If not all is known, it may be provided in phases.
Sources
Last reviewed: 18 October 2026.
