Data security requirements under the Data Protection Act

Section 62 of the Data Protection Act, 2024 requires both controllers and processors to implement technical and organisational measures that provide a level of security appropriate to the risk of the processing. There is no fixed checklist that applies the same way to every business: the Act ties the requirement to risk, cost, and the nature of what is actually being processed.

What the Act asks businesses to weigh up

Section 62 requires taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the rights of data subjects. In effect, a business has to make a genuine assessment of how sensitive its data is, how it is being processed, and what could realistically go wrong, and then choose measures that match that picture rather than picking something arbitrary.

The kinds of measures the Act specifically references

Section 62 points to particular categories of measures a business should consider:

• pseudonymisation and encryption of personal data,
• the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems,
• the ability to restore the availability of and access to personal data in a timely manner if there is a physical or technical incident, and
• a process for regularly testing, assessing and evaluating the effectiveness of these measures.

These are not a menu to pick one from. They describe different aspects of the same problem: keeping data from unauthorised eyes, keeping systems running, being able to recover when something breaks, and checking regularly that all of that is still actually working rather than assuming it is.

What “appropriate to the risk” means for different businesses

A five-person shop keeping a spreadsheet of customer phone numbers for delivery updates needs proportionately less than a bank processing financial records at scale, and section 62’s reference to cost of implementation reflects that. But proportionately less is not the same as nothing. That shop still needs something real in place: a password on the device or file holding the spreadsheet, and access limited to the people who actually need it, rather than an open file anyone in the business can see or a laptop with no password that goes home in a bag every night. The size of the business changes what is proportionate, not whether section 62 applies at all.

Why this connects to breach notification

Inadequate security is usually what leads directly to the notification obligations covered on the data breaches page. A business that has genuinely assessed its risk and put appropriate measures in place under section 62 is less likely to face a breach in the first place, and is in a stronger position to show the Commission what went wrong and what was already being done to prevent it, which matters for the documentation duty that follows a breach.