Which statement best describes the allowed security measures for GDPR processing of personal data?

• A. The cost of implementation.
• B. The state of the art.
• C. The nature, scope, context and purposes of processing.
• D. All of the above.

Answer: (D)

In GDPR, the security measures chosen for processing must be appropriate to the risk, and the appropriateness is defined by weighing several factors. Article 32 requires that technical and organizational measures reflect the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. This means you don’t look at just one factor in isolation—you balance current security capabilities (state of the art) with what is realistically affordable (costs) while tailoring the safeguards to how the data is processed (its nature, scale, context, and purpose). Because all of these elements influence what level of protection is appropriate, the best description is that all of the above factors are taken into account when determining the security measures.