SCENARIO Please use the following to answer the next question: BHealthy, a company based in Italy, is ready to launch a new line of natural products…

According to Article 32 of the GDPR, the controller and the processor must implement appropriate

technical and organisational measures to ensure a level of security appropriate to the risk of the

processing1. The GDPR does not prescribe specific security measures, but rather provides a list of

factors to consider when determining the appropriate level of security, such as:

The state of the art and the costs of implementation;

The nature, scope, context and purposes of processing;

The risk of varying likelihood and severity for the rights and freedoms of natural persons.

Therefore, the level of security required by the GDPR is not absolute, but relative to the specific

circumstances of each processing activity. The GDPR also encourages the use of codes of conduct and

certification mechanisms to demonstrate compliance with the security requirements1.

In the scenario, Natural Insight is a processor who receives customer information from BHealthy, a

controller, for the purpose of providing pricing services. Natural Insight has a contractual obligation

to implement technical and organisational measures to ensure the security of the data, as well as to

comply with the GDPR. Natural Insight’s security obligations are not limited to the measures

assessed by BHealthy prior to entering into the contract, nor to the level of security that a reasonable

data subject would expect. Rather, Natural Insight must take into account the industry practices for

protecting customer contact information and purchase history, as well as the potential risks that may

arise from the processing, such as data breaches, identity theft, fraud, or discrimination. Natural

Insight must also keep up with the state of the art and the costs of implementation, and adjust its

security measures accordingly.

Reference:

4: Art. 32 GDPR Security of processing