CLAIM-2026-09-06-08

GDPR Article 32(1)(d) requires 'a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing'.

Why it matters

This is the specific duty a blind control breaches. Article 32(1)(d) does not ask whether you have a measure — it asks whether you test that it works.

Sources

• intersoftco2026security