Defence Organisations Aren’t Exempt From “Appropriate to the Risk”
GDPR has been enforceable for years, and Article 32 remains the single most commonly cited provision in major fines. Defence organisations handling employee and personnel data are not exempt from this obligation simply because their primary focus is controlled technical data.
Part of the reason is that Article 32 does not read like a checklist. It names four categories of measure in illustrative terms and leaves “appropriate” to be judged against risk. This article walks through what those four categories actually require in practice for defence organisations.
Executive Summary
Article 32 of the GDPR sets out four illustrative categories of technical and organisational measure. None of these are satisfied by a one-time implementation. For defence organisations, the practical task years into the regulation’s life is not asking whether Article 32 was addressed once, but whether it is still being met against current risk.
Key Takeaways
- Article 32 names four illustrative categories of measure, not a fixed checklist.
- “Appropriate to the risk” means the bar moves as data sensitivity and threat landscape change.
- Security failures dominate major GDPR enforcement, not procedural gaps.
- Encryption without customer key control satisfies pseudonymisation weakly.
- The fourth limb, regularly testing effectiveness, is the one most organisations skip entirely.
Why “Appropriate” Is a Moving Target for Personnel Data
Article 32 deliberately avoids naming specific technologies, requiring instead that measures be appropriate to the risk presented by the processing in question.
Risk-Based Language Means the Bar Moves With the Data and the Threat
A measure judged appropriate for a given category of personnel data does not remain appropriate automatically as sensitivity or the threat landscape changes.
Regulators Read “Appropriate” Against What a Reasonable Organisation Would Have Done
Enforcement decisions evaluate whether the measures in place matched what a reasonable organisation, handling that kind of data, would have implemented.
What Each of the Four Categories Actually Requires
Each category has failed in ways that show up repeatedly in enforcement decisions.
Pseudonymisation and Encryption That Actually Limits Exposure
Encryption satisfies this category weakly if the entity holding the encrypted data can also decrypt it as a matter of course.
Ongoing Confidentiality, Integrity, Availability and Resilience
This category is explicitly continuous, not a state assessed once at deployment.
Why This Is Still the Article That Produces the Biggest Fines
Major fines through 2026 continue to centre on inadequate technical and organisational measures following a breach, rather than documentation shortfalls.
Building an Article 32 Programme That Holds Up Years In
The practical response is to treat all four categories as ongoing operational commitments: verify encryption genuinely limits exposure, confirm access controls are monitored continuously, and test disaster recovery on a real schedule.
How a Data Control Plane Supports Continuous Article 32 Compliance
The Kiteworks Data Control Plane supports customer-owned encryption keys through a hardware security module, and audit logs are anonymised by default, adding a genuine pseudonymisation layer. Single-tenant architecture and built-in disaster-recovery configurations support ongoing confidentiality, integrity and resilience, while every action across every channel is captured in a tamper-proof, unthrottled audit log feeding directly into SIEM tooling.
Defence organisations that want to test their current measures against a fresh Article 32 assessment can schedule a custom demo.
Frequently Asked Questions
No, defence organisations handling employee and personnel data are not exempt from Article 32 obligations simply because their primary focus is controlled technical data.
It means measures must be judged against the current risk presented by the processing, and the bar moves as data sensitivity and the threat landscape change rather than remaining fixed after initial implementation.
Major fines continue to centre on inadequate technical and organisational measures following a breach, rather than documentation shortfalls, with the fourth limb of regularly testing effectiveness often skipped entirely by organisations.
Encryption satisfies the category weakly if the entity holding the encrypted data can also decrypt it as a matter of course; stronger compliance requires customer key control to genuinely limit exposure.