Does GDPR require a penetration test?

Who it applies to

Any organization processing the personal data of people in the EU, regardless of where the organization itself is established.

In detail

Article 32 sets the security obligation and is deliberately risk-based: measures must be appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing. It gives examples including pseudonymisation, encryption, and the ability to restore availability after an incident.

Subparagraph (d) is the testing hook. A process for regularly testing, assessing and evaluating effectiveness is a requirement in its own right, separate from having the measures at all. An organization that has controls but never checks whether they work has not met 32(1)(d).

GDPR interacts with the other frameworks here more than it competes with them. An ISO 27001 certification is commonly used to demonstrate appropriate measures under Article 32, and Article 42 contemplates certification mechanisms as a way of demonstrating compliance.

What to have in scope

• Systems processing personal data of people in the EU
• Access controls, encryption in transit and at rest, and data isolation between customers
• Evidence of a repeating test cycle, since 32(1)(d) asks for a process rather than an event
• Findings linked to the record of processing activities and the risk assessment