What does GDPR require for website security?

Article 32 asks the controller and the processor to put in place technical and organisational measures that give a level of security appropriate to the risk. It names examples: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access to data in a timely manner, and a process for regularly testing and evaluating the measures. The law sets the goal; the measures are chosen per site.

Does GDPR list specific security tools a website must use?

GDPR leaves the choice of tools and products to the controller. Article 32 says to take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing. The UK regulator, the ICO, says the same for UK GDPR: the law does not define the measures, and the choice follows a risk assessment. That is why evidence of your reasoning matters as much as the settings.

Is our hosting provider responsible for GDPR security?

Partly. A hosting provider that processes personal data for you is a processor under Article 28. The controller may use only processors that give sufficient guarantees, the contract must oblige the processor to take the measures required by Article 32, and the processor must assist the controller with security and breach duties. Your own configuration of the site stays your responsibility.

What happens if our website leaks personal data?

The controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people. If the risk to people is high, they are informed too, unless an exemption applies, such as encryption that makes the data unintelligible. Every breach must be documented, including those that were not notified.

Do you provide a GDPR compliance certificate for our website?

Our deliverable is a set of checked, fixed and documented security measures that your data protection lead can show to an authority or a customer. Legal assessments, privacy notices and the decision on whether you comply are the job of your lawyer or data protection officer.

How much does GDPR website security work cost?

The price depends on the number of sites and forms, the systems that receive the data such as CRM and email tools, the hosting setup and whether we also make the fixes. After a 30-minute call we send a scope letter with a fixed price.

GDPR Website Security Requirements: Art. 32 in Practice

GDPR website security requirements come mainly from Article 32: the people who run a website that handles personal data must protect it with measures appropriate to the risk, and be able to show it. We check and fix those measures on your site and the systems behind it: forms, hosting, plugins, accounts, encryption, backups and breach readiness. You get a secured site and a written record of the measures for your data protection lead.

What Article 32 actually requires

Article 32 sets an outcome and a list of examples. The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

The article lists, as appropriate: pseudonymisation and encryption; the ability to ensure ongoing confidentiality, integrity, availability and resilience; the ability to restore availability and access to personal data in a timely manner after an incident; and a process for regularly testing, assessing and evaluating the measures. Article 32(2) points at the risks to weigh: accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

GDPR articles that shape website security

Several articles beyond Article 32 decide how a website should be set up and run. The table links each to what it means for a typical business site.

Article	What it means for a website	Source
Art. 5(1)(f)	Personal data is processed with appropriate security, including protection against loss and unauthorised access	GDPR
Art. 25	Protection built into the design, and by default only the data needed for each purpose	GDPR
Art. 28	Hosting, form, CRM and email providers act as processors, under a contract that includes Article 32 measures	GDPR
Art. 32(1)(a)	Encryption in transit and, where useful, at rest	GDPR
Art. 32(1)(c)	A working, tested way to restore data after an incident	GDPR
Art. 32(1)(d)	Regular testing of the measures, with results	GDPR
Art. 33	Breach notification to the authority within 72 hours where feasible; documentation of every breach	GDPR
Art. 34	Informing people when a breach is likely to result in a high risk to them	GDPR

Where personal data lives on a business website

Personal data on a website is rarely limited to the database. Contact forms send copies by email, plugins log submissions, analytics and chat tools collect identifiers, and backups keep everything for months.

Our first step is a data path map for the site: each form, newsletter sign-up, account area, booking or payment step, where the data goes after the click, who can read it there, and how long it stays. This map is what the rest of the work and your records of processing build on.

Measures we check and fix

We review the measures that protect that data path and fix what falls short. The work is technical; your data protection lead keeps the legal assessment.

Encryption: TLS for every page and endpoint, secure cookie flags, encrypted backups, form submissions kept out of plain email where possible.
Access: named administrator accounts, multi-factor sign-in, removal of former staff and contractors, least-privilege roles in CMS, hosting and CRM.
Components: CMS, plugins and themes up to date; unused ones removed; third-party scripts listed with their purpose.
Data minimisation: form fields limited to what the purpose needs, retention settings for submissions and logs, test data removed.
Resilience: backups stored separately from the site and proven by a restore test.
Testing: a dated security check of the site, with findings closed and re-checked.
Detection and breach readiness: alerts for file changes and new administrators, logs kept long enough to reconstruct an incident, and a short runbook so the 72-hour clock can be met.

What you receive

You receive a secured site and a written record of its security measures that your data protection lead can rely on.

The website data path map.
A security report with confirmed findings, severity and the fix, sorted into today, this month and later.
A record of technical measures per Article 32 point, written for your records of processing and your data protection lead.
The fixes, if ordered, and a re-check that confirms each one.
A processor list for the website (hosting, forms, email, CRM, analytics) for your lawyer to match against contracts.
A breach runbook for the website: who is called, what is preserved, which facts the controller needs for a notification.

What we need from you

We need administrator access to the CMS and hosting, a list of the tools connected to the site, a contact person on the data protection side, and a signed scope letter.

Boundaries

Our work covers the security measures of your website and its connected tools. We do not act as your data protection officer, we do not give legal opinions, and we do not write privacy notices or contracts; your lawyer or DPO does. The decision to notify a supervisory authority or the people affected is yours, and your company files it. The supervisory authority, and in the UK the ICO, decides whether the measures were appropriate.

Risks of treating GDPR security as a cookie banner

When website GDPR work stops at the cookie banner and the privacy notice, Article 32 stays untouched. A template "technical and organisational measures" document copied from the internet describes controls your site may not have, and that gap shows the moment an incident is investigated.

A chatbot can summarise the article, and it cannot see that your contact form sends every submission to a shared mailbox with no multi-factor sign-in. A freelancer may harden the server and leave no record. We check the real site, fix it and document the measures so your DPO can rely on them.

Who does the work

Security engagements are contracted with INNOVA CONSULT LTD., Ottawa, Ontario (Corporations Canada, Corporation Number 1522612). Client data is covered by a confidentiality agreement, and the report belongs to you. The team runs its own servers and more than 80 websites under daily vulnerability checks.

Cost

A fixed price is set in the scope letter after a 30-minute call. It depends on the number of sites, forms and connected tools.

Related services

Website security audit as the regular test under Article 32(1)(d).
Website security monitoring for early detection.
Hacked website repair after an incident.
PCI DSS 6.4.3 and 11.6.1 for online stores if you take card payments. All cybersecurity services.

Sources (checked 2026-10-23)

Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex: Articles 5, 25, 28, 32, 33 and 34.
Information Commissioner's Office, A guide to data security (UK GDPR).
European Data Protection Board, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 (final version published 4 April 2023).

Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.

GDPR security for your website: Article 32 measures and evidence

Bring the real problem. Leave with a sequence.