GDPR Article 32
for engineering teams.

Article 32 doesn't tell you what to build. It says implement "appropriate technical and organisational measures" with reference to four named ones — pseudonymisation, encryption, CIA, restore — and then defers to risk assessment. That phrasing is what makes it confusing for engineers.

The phrasing is also what makes Article 32 the most-cited article in supervisory action. Below is the version where every paragraph is a concrete engineering surface, with the evidence supervisors actually look for.

Implement pseudonymisation and encryption of personal data — TLS 1.2+ in transit, AES-256 at rest, KMS with key rotation ≤ 365 days.

Ongoing confidentiality, integrity, availability, and resilience of processing systems and services.

Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.

Process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures.

Risk assessment must consider risks of unauthorised access, accidental loss, alteration, or disclosure.

Natural persons under controller authority process personal data only on documented instructions, with technical enforcement.

The full Article 32 surface is bundled in RuleMesh as access-control-security: 19 IT requirements, 89 evidence checks, 17 high-risk items, mapped to AWS, Azure, GCP, NIST CSF, and OWASP Top 10.

~/your-repo $ claude mcp add rulemesh

# in your agent:
Pull the access-control-security bundle from rulemesh. For each
requirement, walk the repo and infrastructure config, decide met /
partial / todo, capture evidence references, and submit signals.
Then print a markdown report grouped by paragraph (32(1)(a),
32(1)(b)...).

• Article 32 checklist (lighter version) →
• Run a GDPR audit with your coding agent →
• Full cloud control mappings →
• NIST / OWASP / ISO mappings →