The GDPR states that you need to implement ‘appropriate’ technical and organisational measures; in this regard, the meaning of ‘appropriate’ is a crucial term to understand for your compliance with the GDPR. You will only know what is appropriate measures when you have assessed the risks of your organisation’s processing of personal data. So, you need to do a risk assessment.  Based on the results of your risk assessments, you will know what threats and potential consequences your organisation faces. Afterwards, it is essential to mitigate these risks by adopting ‘appropriate’ organisational and technical measures.