For a DevOps lead, GDPR becomes four concrete duties: secure processing under Article 32, breach notice to the regulator within 72 hours of awareness under Article 33, keeping personal data no longer than necessary under Article 5, and supporting the records and processor terms the company must maintain. Legal owns the interpretation; you own the systems that make it true.
What does Article 32 ask of infrastructure?
It requires technical and organisational measures appropriate to the risk, and gives examples: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore availability after an incident, and a process for regularly testing and evaluating the measures. There is no fixed control list. You choose measures in proportion to the data and document why.
In practice that means encryption at rest and in transit, access limited by role, tested backups with a restore drill, and a patching routine you can show.
What does the 72 hour clock mean for on-call?
Article 33 says the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a breach, unless it is unlikely to result in a risk to people. Late notice must give reasons. Processors must tell the controller without undue delay.
The engineering consequence is detection and triage speed. The clock starts at awareness, so your alerting, severity rules and escalation path decide how fast the company learns. Decide in advance who can declare a personal data incident at 3 a.m., and make sure that person can reach the privacy lead.
Where does retention bite?
Article 5 sets storage limitation: data kept in identifiable form no longer than necessary for its purpose. Logs, backups, analytics exports and test databases copied from production all count. A common finding is a staging database holding a full production copy from years ago.
Set retention per data store, write it down, and automate deletion. Backups are the awkward case. Decide how long they live and how deletion requests are handled when data sits in an older backup.
What are records and processor terms?
Article 30 requires records of processing activities, and Article 28 requires a contract with each processor covering security and sub-processors. DevOps contributes the data map: which systems hold personal data, where they run, and which vendors touch them. Without that map, legal cannot complete either.
What do you decide, and what is not yours?
You decide: encryption approach, log content and retention, backup policy, access model, and detection tooling. You do not decide the lawful basis for processing, whether a breach is notifiable, or what a regulator is told. Hand facts to the privacy lead fast and let them make that call.
How to check or apply this
- Build a list of every system and vendor that stores personal data, with region.
- Set and document retention for logs, backups and non-production copies.
- Confirm encryption and access controls on each store, with evidence.
- Write a breach runbook that starts the clock at first awareness and names the decision maker.
- Run a restore test and a tabletop for a data incident this quarter.
- Strip personal data from log lines wherever possible.
Quick check
Does GDPR require encryption?
Article 32 lists it as an example of an appropriate measure, not a blanket mandate. You choose measures based on risk and document the reasoning.
When does the 72 hours start?
When the controller becomes aware of the breach, per Article 33, not when the incident began.
Sources
- GDPR Article 32, security of processing
- GDPR Article 33, breach notification
- GDPR Article 5, principles
- GDPR Article 28, processor
- GDPR Article 30, records of processing
Last reviewed: 18 October 2026.
