Security obligations under GDPR: what "appropriate" means

The short answer

The regulation does not list mandatory security products. It requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, together with the likelihood and severity of the risk to people’s rights and freedoms. It names categories to consider: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of processing systems, the ability to restore availability and access after an incident, and a process for regularly testing, assessing and evaluating effectiveness. Appropriateness is relative to risk rather than to company size, so a small business holding health or financial details is expected to protect them properly. For a business website, this translates into a concrete and unsurprising list, and the measures most often missing when things go wrong are the cheap, standard ones: second factors on administrative accounts, patching, tested backups and least-privilege access.

What appropriate looks like for a website

Measure	Why it is expected	Cost
HTTPS everywhere with HSTS	Data in transit; standard practice	None
Multi-factor authentication on all administrative accounts	The most common breach route	None
Least privilege and per-person accounts	Limits exposure; enables offboarding	None
Patching and dependency updates within defined times	Known vulnerabilities are exploited quickly	Small
Encryption at rest for databases and backups	Named in the regulation; default on managed services	Usually included
Tested backups and a documented restore	Availability and restoration are explicit requirements	Small
Logging and alerting	Detection and investigation	Small
Input validation, secure forms, rate limiting	Prevents the common web attacks	Build-time
Processor selection and agreements	Required for suppliers	Administrative
Retention limits	Less data held, less exposed	Administrative
Staff awareness	Phishing is the leading entry point	Small
Regular testing and review	Explicitly required	Scan plus annual review

Demonstrating it

The link to retention

Security and retention are connected in a way small businesses underestimate. The most effective way to reduce the impact of a breach is to hold less data: enquiries deleted after a defined period, old customer records archived or removed, exports cleaned up. A business with a clear retention schedule that it actually applies converts a potential large incident into a small one, and it is a measure available to anyone at no cost.

What this means for you

Appropriate means proportionate to the risk to the people whose data you hold, judged against what is standard and affordable. For a website that means HTTPS, second factors, least privilege, patching, encryption at rest, tested backups, logging, secure forms, processor agreements, retention limits, training and regular testing, with the measures written down and verified. Reduce what you hold as well as protecting it. This is general information rather than legal advice.