ESSENTIAL GUIDANCE · BUYER GUIDE · 3 min read
Part of Validate insights →GDPR security testing and Article 32 assurance
Use a risk-based security assessment to support personal-data protection, with clear scope, handling and remediation evidence.
Use a risk-based security assessment to support personal-data protection, with clear scope, handling and remediation evidence.
Need an acronym translated?Open the cyber glossary →Begin with the processing and likely harm
Security testing should follow an understanding of the personal information, people, systems and processing involved. Identify how a loss of confidentiality, integrity or availability could affect individuals and services. ICO guidance explains the risk-based security obligations. A generic test of public addresses cannot, by itself, establish that an organisation's personal-data processing complies with the law.
Map data flows and access boundaries
Document collection, administration, interfaces, storage, exports, supplier access and deletion paths that matter to the assessment. Identify the roles that can see or change different records. Include important tenant or customer boundaries. The objective is to choose useful tests for the processing risk, rather than allowing an incomplete asset list to define the evidence accidentally.
Choose complementary assurance methods
Configuration review, access assessment, secure-development checks, penetration testing and operational exercises can address different concerns. Select the method that answers the stated question. Do not equate one technical report with every organisational and legal obligation. Record where other evidence, such as recovery testing or access governance, is necessary to understand the security of the processing.
Minimise the information used during testing
Use suitable test accounts and synthetic or otherwise controlled records where practicable. Agree how evidence will be collected, protected, shared and removed. Define how an unexpected discovery of real personal information will be handled. Explicit written authorisation, clear scope and supplier permissions are required before active testing. Avoid copying large amounts of production data simply to make a report look convincing.
Connect findings to protective action
Prioritise observations using the information affected, access conditions and credible consequence. Assign an owner and agree what will change. Retain appropriate follow-up evidence, especially where a correction changes how one user can access another person's information. Keep the boundaries of the check visible so a corrected endpoint does not imply every related workflow has been assessed.
Keep the compliance conclusion proportionate
Security testing provides bounded technical evidence. It does not establish a lawful basis, settle every privacy obligation or automatically demonstrate GDPR compliance. Use the assessment within a broader security and data-protection process, informed by the current ICO guidance and relevant specialist advice. Record review dates and material changes so evidence remains connected to the system and processing it actually describes.
This guide covers the essentials. Continue into our technical analysis for a firmer position, practical implications and recommended action.
Read “Modern penetration testing should create decisions, not just findings” →
