The GDPR requires data controllers and processors to implement technical and organizational measures (TOMs) to ensure the reasonable safety of their data processing operations. The GDPR adopts a risk-based approach to determine what level of technical and organizational measures are required in each case. Relevant factors include the nature and volume of the data processing activities, criticality of the data processed and the risks associated with the specific processing operations.