Technical and Organizational Measures (often referred to as TOMs) are precautions taken by an organization to protect personal data and to prove compliance with various aspects of privacy laws, like GDPR in the EU. They are essentially the steps a company takes to ensure data is secure, privacy is maintained, and that they can demonstrate this security and privacy to external auditors or authorities. Below are examples of technical and organizational measures often included as part of the data protection block.