If your business holds personal data about customers, staff or suppliers, UK GDPR requires you to keep it secure. The rule is short, but working out what it means for a 20-person company with a website, Microsoft 365 and a few cloud servers takes more thought. This post covers the security principle and Article 32, what to do when something goes wrong, what the Data (Use and Access) Act 2025 changed, and the controls that cover most of what the ICO expects.
Article 32: appropriate technical and organisational measures
Article 32 requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The ICO is clear that there is no one-size-fits-all answer. What counts as appropriate depends on the state of the art, the cost of implementation, the nature, scope, context and purposes of your processing, and the risk to individuals. A payroll bureau and a florist with a mailing list have different obligations in practice.
Article 32 names the measures to consider, where appropriate:
- Pseudonymisation and encryption of personal data. The ICO recommends encrypting stored data and data sent over the internet, since it is cheap and widely available.
- The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
- The ability to restore availability and access to personal data in a timely manner after a physical or technical incident. In practice that means backups that you have actually restored from.
- A process for regularly testing, assessing and evaluating the effectiveness of your measures, such as vulnerability scanning and penetration testing, with the results documented and acted on.
'Organisational' matters as much as 'technical'. Policies, staff training, access approval, supplier contracts and an incident plan are all part of it. If you use processors (a hosting company, a payroll provider, a CRM), you must choose ones that give sufficient guarantees and put Article 32 obligations in the contract.
Where Cyber Essentials fits
The ICO describes Cyber Essentials as a good starting point for the basic technical controls, while noting it may not be enough on its own, depending on what you process. That's a fair summary. Cyber Essentials covers firewalls, secure configuration, patching within 14 days, access control with MFA on cloud services, and malware protection. It doesn't cover backups (which the NCSC recommends but doesn't assess), encryption, logging, incident response or supplier management, all of which Article 32 can require. See the Cyber Essentials 2026 guide for what the April 2026 Danzell changes mean.
Personal data breaches: the 72-hour rule
A personal data breach is wider than a hack. It includes accidental deletion, data sent to the wrong person, a lost laptop and ransomware that makes data unavailable. The ICO's guidance sets out the obligations:
- Report to the ICO within 72 hours of becoming aware of the breach, where feasible, unless it is unlikely to result in a risk to people's rights and freedoms. If you report late, give reasons for the delay.
- You can report in phases. If you can't finish investigating within 72 hours, report what you know and send the rest without undue delay.
- Tell affected individuals without undue delay if the breach is likely to result in a high risk to them, in plain language, with what happened, the likely consequences, what you are doing, and practical advice such as resetting passwords.
- Record every breach, including ones you decide not to report, with the facts, effects and remedial action, and document why you did not report.
- Processors must tell the controller without undue delay. Put this in your contracts.
The 72 hours runs from when you become aware, not from when you finish investigating. Decide in advance who makes the call and who submits the report. The ICO notes that failing to notify a reportable breach can itself lead to a fine of up to £8.7 million or 2% of global turnover.
A worked example: PHP2Shell
Suppose your customer portal runs PHP and was not patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619, fixed upstream on 21 October 2026). Sources differ on how widely it has been exploited: watchTowr reports exploitation in the wild since 21 October, while CISA said at publication that it had not observed successful exploitation. In this scenario, patching is step one, and the next question is whether anyone got in before you patched. If you find indicators of compromise on a server that holds personal data, such as a web worker spawning a shell or unexpected files, you may have a reportable breach, and the 72-hour clock starts when you become aware of it, not when you're sure. The PHP2Shell explainer lists the indicators to look for.
What the Data (Use and Access) Act 2025 changed
The Data (Use and Access) Act 2025 (DUAA) amends UK GDPR, the Data Protection Act 2018 and PECR. The ICO says most data protection provisions took effect on 5 February 2026, and the remaining provisions on 19 June 2026. For a typical SME's security obligations, the headline is what did not change: the ICO's summary of the changes doesn't alter the Article 32 security duty or the 72-hour breach reporting rule. The ICO says its security guidance is under review because of the Act, so check for updates. The changes most SMEs will notice:
- Complaints handling. You must give people a way to make a data protection complaint (for example, an electronic form), acknowledge complaints within 30 days, investigate, and tell them the outcome without undue delay. The ICO confirmed this is now in force.
- Subject access requests. You only need to carry out reasonable and proportionate searches, and the time limit starts once you have the request plus any identity information you need. You can also pause the clock while you ask the requester to clarify.
- Recognised legitimate interests. A new lawful basis for listed purposes such as crime prevention, safeguarding and emergencies. The Act also names network and information security as an example of a legitimate interest.
- PECR. Fines for PECR breaches (marketing calls, emails, cookies) can now reach the UK GDPR maximum of £17.5 million or 4% of global turnover. Communications providers now have 72 hours, not 24, to report PECR security breaches, and some low-intrusion cookies no longer need consent.
- Automated decisions. Solely automated significant decisions are permitted in more situations, provided safeguards are in place. Special category data remains restricted.
A practical control set for SMEs
Here is a reasonable baseline for a business without a security team. It isn't a legal standard, just the controls that come up again and again in ICO guidance and NCSC advice:
- Know your data. A simple record of what personal data you hold, where it lives (including SaaS and cloud servers) and which suppliers process it.
- MFA everywhere it is available, starting with email, admin accounts and anything internet-facing.
- Patching with a deadline. Critical and high-risk updates within 14 days (the Cyber Essentials standard), faster for actively exploited issues like PHP2Shell. Remove or isolate unsupported software.
- Least privilege. Separate admin accounts, prompt removal of leavers, and periodic review of who can access what.
- Encryption on laptops and phones, in transit (TLS) and at rest in cloud storage and databases.
- Backups you have tested, with at least one copy that ransomware on your network can't reach.
- Logging and alerting on the systems that hold personal data, so you can tell what happened and when. On AWS, see the AWS security baseline checklist.
- An incident plan on one page: who decides whether a breach is reportable, how to reach them out of hours, the ICO reporting route, and a breach log template.
- Supplier contracts with Article 28 processor terms, including breach notification without undue delay.
- Regular testing: vulnerability scans at minimum, with results tracked to closure.
If you use AI tools on personal data, the same principles apply. See AI data privacy and governance.
Writing it down
Under UK GDPR's accountability principle you must be able to show what you did, not just do it. Keep a short security policy, your risk decisions, test results, training records and the breach log. If the ICO ever asks, a modest set of controls that you can evidence is worth more than impressive ones you can't.
HashTech helps UK businesses assess and fix the technical side of these obligations, including Cyber Essentials readiness; see our UK services.
