Manufacturers Handle Personal Data Too
GDPR has been enforceable for years, and Article 32 remains the single most commonly cited provision in major fines. Manufacturers processing employee, customer and supplier personal data alongside engineering data are not exempt from this obligation.
Part of the reason is that Article 32 does not read like a checklist. It names four categories of measure in illustrative terms and leaves “appropriate” to be judged against risk. This article walks through what those four categories actually require in practice for manufacturers.
Executive Summary
Article 32 of the GDPR sets out four illustrative categories of technical and organisational measure. None of these are satisfied by a one-time implementation. For manufacturers, the practical task years into the regulation’s life is not asking whether Article 32 was addressed once, but whether it is still being met against current risk.
Key Takeaways
- Article 32 names four illustrative categories of measure, not a fixed checklist.
- “Appropriate to the risk” means the bar moves as data sensitivity and threat landscape change.
- Security failures dominate major GDPR enforcement, not procedural gaps.
- Encryption without customer key control satisfies pseudonymisation weakly.
- The fourth limb, regularly testing effectiveness, is the one most manufacturers skip entirely.
Why “Appropriate” Is a Moving Target for Personal Data
Article 32 deliberately avoids naming specific technologies, requiring instead that measures be appropriate to the risk presented by the processing in question.
Risk-Based Language Means the Bar Moves With the Data and the Threat
A measure judged appropriate for a given category of personal data does not remain appropriate automatically as sensitivity or the threat landscape changes.
Regulators Read “Appropriate” Against What a Reasonable Manufacturer Would Have Done
Enforcement decisions evaluate whether the measures in place matched what a reasonable manufacturer, handling that kind of data, would have implemented.
What Each of the Four Categories Actually Requires
Each category has failed in ways that show up repeatedly in enforcement decisions.
Pseudonymisation and Encryption That Actually Limits Exposure
Encryption satisfies this category weakly if the entity holding the encrypted data can also decrypt it as a matter of course.
Ongoing Confidentiality, Integrity, Availability and Resilience
This category is explicitly continuous, not a state assessed once at deployment.
Why This Is Still the Article That Produces the Biggest Fines
Major fines through 2026 continue to centre on inadequate technical and organisational measures following a breach, rather than documentation shortfalls.
Building an Article 32 Programme That Holds Up Years In
The practical response is to treat all four categories as ongoing operational commitments: verify encryption genuinely limits exposure, confirm access controls are monitored continuously, and test disaster recovery on a real schedule.
How a Data Control Plane Supports Continuous Article 32 Compliance
The Kiteworks Data Control Plane supports customer-owned encryption keys through a hardware security module, and audit logs are anonymised by default, adding a genuine pseudonymisation layer. Single-tenant architecture and built-in disaster-recovery configurations support ongoing confidentiality, integrity and resilience, while every action across every channel is captured in a tamper-proof, unthrottled audit log feeding directly into SIEM tooling.
Manufacturers that want to test their current measures against a fresh Article 32 assessment can schedule a custom demo.
Frequently Asked Questions
Security failures dominate major GDPR enforcement decisions rather than documentation shortfalls, and Article 32 requires ongoing technical and organisational measures that remain appropriate to current risk levels.
The phrase means the required measures are not fixed; the bar moves as data sensitivity and the threat landscape change, and regulators assess whether a reasonable manufacturer handling similar data would have implemented the same controls.
Encryption satisfies the requirement weakly if the organisation holding the data can decrypt it as a matter of course; genuine limitation of exposure requires customer-owned encryption keys.
The fourth limb—regularly testing, assessing and evaluating the effectiveness of measures—is the requirement most often omitted entirely from compliance programmes.