Drafting GDPR Art. 32 TOMs with AI from your NIS2 records

What Art. 32 GDPR asks of your TOMs

TOMs are the technical and organisational measures you use to protect personal data. Art. 32(1) GDPR requires controllers and processors to ensure a level of security appropriate to the risk for the rights and freedoms of natural persons. They take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the varying likelihood and severity of the risk.

The measures include, in the words of the law, “inter alia as appropriate”. Point (a): “the pseudonymisation and encryption of personal data”. Point (b): “the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services”.

Point (c): “the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident”. Point (d): “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”.

Art. 32(1) GDPR

Which records in the NIS 2 walkthrough fit

The mapping below is our own; no supervisory authority has confirmed it. For point (a): 9.1 records your accepted methods and your cryptography policy, meaning what you encrypt with, where, and how you handle keys. The walkthrough contains nothing on pseudonymisation.

For point (b): the policy in 10.1 sets out who gets into what, who is bound to confidentiality, and what happens when someone leaves. 11.1 records where a second factor protects a sign-in, and 4.2 which processes must keep running without IT.

For point (c): 4.4 gives, for each backup system, how often it backs up and when a restore from it last worked. The business continuity plan in 4.2 says who restores the systems.

For point (d): the management review in 7.3 records when management looked at where things stand, who took part and what it decided. NIS 2 asks for procedures to assess the effectiveness of the measures (Art. 21(2)(f)).

Art. 21(2)(c), (f), (h), (i) and (j) NIS 2 · § 30(2) BSIG

What your NIS 2 records do not cover

Art. 21 NIS 2 protects network and information systems, whether or not they hold personal data. Art. 32 GDPR asks about the risk to the people whose data you process. Many measures serve both, but the question behind them differs.

The rating in 2.3 estimates how often something happens and how big the damage would be. The examples for it in 2.1 mean damage to the business, such as a day without shipping. The walkthrough does not explicitly ask about the risk to data subjects.

Also missing are pseudonymisation and the question of which measure applies to which processing. A draft from the walkthrough therefore covers only part of Art. 32, and your company adds the rest.

How an assistant writes the draft

An AI assistant connects to your company in nisd2.eu through MCP (Model Context Protocol), an open standard. With the get_walkthrough tool it reads the items in the areas assigned to the person who connected it, including finished and approved ones.

It writes the draft outside the walkthrough, as an answer in the chat or as a file. The document belongs to your company, and you file it wherever you keep your data protection records. The walkthrough has no screen for TOMs.

Have it back every statement with the item it comes from, and flag every gap. A request to the assistant can read like this:

Use get_walkthrough to read items 9.1, 10.1, 11.1, 4.2, 4.4 and 7.3. From them, draft a description of our technical and organisational measures under Art. 32(1) GDPR, structured by points (a) to (d). For every statement, name the item it comes from. Flag every point for which the walkthrough contains nothing. Do not enter anything in the walkthrough.

What your company checks afterwards

Whether a measure is appropriate to the risk is for your company to decide as controller (Art. 32(1)). First check that every statement in the draft is true in your business. The walkthrough holds what people or an assistant entered.

Management's approval in 7.3 covers the walkthrough's NIS 2 documents. It does not approve your TOMs draft. Your company reviews that separately, with your data protection officer where one is designated.

If something later changes in the walkthrough, such as the date in 4.4 after a new restore test, the draft does not change with it. The GDPR requires measures to be reviewed and updated where necessary (Art. 24(1)).

Art. 24(1) · Art. 32(1) GDPR