26From that point of view, Article 32 of the GDPR sets out the obligations of the controller and a possible processor as regards the security of that processing. Thus, paragraph 1 of that article provides that the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks mentioned in the previous paragraph of this judgment, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing concerned.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.