42It is apparent from Article 32(1) and (2) that the appropriateness of such organisational and technical measures must be assessed in two stages. First, it is necessary to identify the risks of a personal data breach caused by the processing concerned and their possible consequences for the rights and freedoms of natural persons. That assessment must be carried out in a concrete manner, taking into account the likelihood of the risks identified and their severity. Secondly, it is necessary to ascertain whether the measures implemented by the controller are appropriate to those risks, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of that processing.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.