Which option is not typically cited as a technical or organizational measure under GDPR Article 32?

• A. Encryption
• B. Pseudonymisation
• C. Access controls
• D. Data minimization

Answer: (D)

Under GDPR, Article 32 focuses on technical and organizational measures that protect personal data based on the level of risk. Encryption and pseudonymisation are classic technical measures that reduce risk by making data unreadable or less directly identifiable. Access controls are also a standard control, limiting who can view or process data. Data minimization, while crucial for reducing the amount of data collected and retained, is a data governance principle tied to limiting data processing, not a specific security control listed in Article 32. It helps reduce potential exposure, but it’s not described as a technical or organizational measure in the article. Therefore, data minimization is not typically cited as a security measure under Article 32.