1. GDPR AND CYBERSECURITY: THE COMPLETE 2026 GUIDE TO WHAT UK BUSINESSES ARE LEGALLY REQUIRED TO DO AFTER A DATA BREACH

There is a specific moment, somewhere between discovering that a system has been compromised and deciding what to do about it, when a UK business stops dealing purely with a technical problem and starts dealing with a legal one. That moment arrives the instant personal data is confirmed, or even reasonably suspected, to have been involved. From that point, the clock the regulator cares about is running, whether or not anyone inside the organisation has noticed it yet, and the decisions made in the following hours and days are judged against a specific statutory standard rather than against whatever felt reasonable at the time.

UK GDPR, sitting alongside the Data Protection Act 2018, does not simply encourage good cybersecurity practice as a general aspiration. It imposes specific, enforceable obligations: a duty to implement appropriate technical and organisational security measures before anything goes wrong, and a duty to report a qualifying personal data breach to the Information Commissioner’s Office within a strict 72 hour window once discovered, with serious financial and reputational consequences attached to getting either obligation wrong. Understanding exactly what these obligations require, in practical and legally accurate terms, is not optional reading for a UK business. It is the difference between a breach that is handled defensibly and one that compounds into a regulatory enforcement action on top of the original incident.

Oracle Mobile Security Ltd is a UK-headquartered digital intelligence firm providing certified ethical hackers for incident response, penetration testing, secure code review, and the full range of cybersecurity and digital forensics services that support GDPR compliance, to businesses, legal professionals, and organisations across the United Kingdom, the United States, and internationally. CEH and OSCP certified. Available 24/7.

Visit https://www.oraclemobilesecurity.com/ or contact the team at https://www.oraclemobilesecurity.com/contact-us/ to begin a free confidential consultation.

📋 2. WHAT IS THE RELATIONSHIP BETWEEN GDPR AND CYBERSECURITY?

2.1 WHAT DOES UK GDPR ACTUALLY REQUIRE WHEN IT COMES TO CYBERSECURITY?

UK GDPR, as retained and amended following the EU Withdrawal Act and sitting alongside the Data Protection Act 2018, requires every organisation processing personal data to implement security measures appropriate to the risk that processing presents. This obligation, set out specifically in Article 32, is not satisfied by general good intentions. It requires organisations to actively assess risk and implement specific, demonstrable technical and organisational measures, and to be able to evidence that assessment if challenged by the regulator. The full text of UK GDPR is maintained at https://www.legislation.gov.uk/eur/2016/679/contents, and the Information Commissioner’s Office provides UK-specific guidance on Article 32 obligations at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/.

2.2 WHO IS A DATA CONTROLLER AND WHO IS A DATA PROCESSOR, AND WHY DOES THE DISTINCTION MATTER FOR SECURITY OBLIGATIONS?

A data controller determines the purposes and means of processing personal data, while a data processor processes personal data on the controller’s behalf and instruction. Both carry direct security obligations under UK GDPR, though the controller bears primary accountability for ensuring appropriate security measures exist across the entire processing relationship, including verifying that any processor it engages, such as a cloud hosting provider or a third-party payment processor, meets the same standard. This distinction matters significantly when a breach occurs within a third-party processor’s systems, since the controller cannot simply point to the processor’s failure as a complete defence.

2.3 WHAT DOES “APPROPRIATE TECHNICAL AND ORGANISATIONAL MEASURES” ACTUALLY MEAN IN PRACTICE?

This phrase, used throughout UK GDPR without a fixed checklist, is deliberately risk-based rather than prescriptive, meaning the appropriate measures for a small business processing limited customer data differ from those expected of a financial services firm processing sensitive financial records at scale. In practice, regulators and courts look for evidence of structured risk assessment, regular security testing such as penetration testing following NIST SP 800-115 at https://www.nist.gov/publications/technical-guide-information-security-testing-and-assessment, secure development practices including code review aligned to OWASP standards at https://owasp.org, encryption of personal data where appropriate, and a documented incident response capability, rather than any single specific technical control in isolation.

⏱️ 3. WHAT ARE THE GDPR BREACH NOTIFICATION REQUIREMENTS?

3.1 WHAT COUNTS AS A PERSONAL DATA BREACH UNDER UK GDPR?

A personal data breach is defined broadly under UK GDPR as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This definition extends well beyond the scenario most people picture when they hear the term breach. It includes a misdirected email containing personal data, a lost unencrypted laptop, a ransomware attack that encrypts personal data without necessarily exfiltrating it, and an employee accessing personal data outside their authorised role. The ICO’s guidance on what constitutes a breach is at https://ico.org.uk/for-organisations/report-a-breach/personal-data-breaches/.

3.2 WHAT IS THE 72 HOUR RULE AND HOW IS THE CLOCK CALCULATED?

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, UK GDPR requires the controller to notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The 72 hour clock begins not when the breach technically occurred, but when the organisation became aware of it, meaning the moment of discovery, not the moment of compromise, is the legally relevant starting point. The ICO’s specific guidance on the 72 hour reporting requirement is at https://ico.org.uk/for-organisations/report-a-breach/.

3.3 WHAT INFORMATION MUST BE INCLUDED IN AN ICO BREACH NOTIFICATION?

A compliant breach notification to the ICO must include the nature of the breach, the categories and approximate number of individuals and personal data records affected, the name and contact details of the organisation’s data protection officer or another contact point, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects. Where full information is not yet available within the 72 hour window, UK GDPR permits a phased notification, with the organisation providing further information as the investigation progresses, provided the initial notification is made promptly and explains why complete information could not be provided immediately.

3.4 WHEN DOES A BREACH ALSO NEED TO BE COMMUNICATED DIRECTLY TO AFFECTED INDIVIDUALS?

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, UK GDPR requires the controller to communicate the breach to affected individuals directly, without undue delay, in addition to notifying the ICO. This higher threshold typically applies to breaches involving sensitive categories of data, financial information, or circumstances where individuals need to take protective action themselves, such as changing a compromised password.

3.5 WHAT HAPPENS IF AN ORGANISATION FAILS TO REPORT A BREACH WITHIN THE REQUIRED TIMEFRAME?

Failure to notify the ICO within the required timeframe, where notification was required, is itself a separate compliance failure distinct from the underlying breach, and can result in regulatory enforcement action including financial penalties. The ICO’s enforcement powers and the broader regulatory action framework are set out at https://ico.org.uk/action-weve-taken/enforcement/, and organisations should treat the reporting obligation as a strict legal deadline rather than a discretionary best practice.

💰 4. WHAT ARE THE FINANCIAL AND REGULATORY CONSEQUENCES OF NON-COMPLIANCE?

4.1 WHAT ARE THE MAXIMUM FINES FOR A GDPR SECURITY OR BREACH NOTIFICATION FAILURE?

UK GDPR provides for a two-tier penalty structure, with the most serious infringements, including significant failures of the security obligations under Article 32 or failure to notify a qualifying breach, attracting fines of up to seventeen and a half million pounds or four percent of the organisation’s total annual worldwide turnover, whichever is higher. The ICO’s guidance on its penalty framework and the factors considered when determining fine amounts is at https://ico.org.uk/for-organisations/the-guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/enforcement/.

4.2 WHAT FACTORS DOES THE ICO CONSIDER WHEN DECIDING ENFORCEMENT ACTION AND FINE AMOUNTS?

The ICO considers a range of factors when determining enforcement action, including the nature and severity of the infringement, whether it was intentional or negligent, the degree of cooperation shown by the organisation during the investigation, any prior history of non-compliance, and crucially, the technical and organisational security measures the organisation had in place before the breach occurred. This last factor is precisely where documented, regular security testing becomes directly relevant to regulatory outcomes, since an organisation that can demonstrate a structured testing programme is positioned very differently from one that cannot.

4.3 BEYOND REGULATORY FINES, WHAT OTHER CONSEQUENCES FOLLOW A REPORTABLE DATA BREACH?

Beyond ICO fines, organisations frequently face civil claims from affected individuals, reputational damage affecting customer trust and retention, contractual consequences where business partners require security warranties, and increased scrutiny in future regulatory engagement. Cyber insurance policies frequently require evidence of appropriate security measures as a condition of coverage, meaning a documented testing and compliance programme can directly affect both insurability and claim outcomes following an incident.

🛡️ 5. WHAT SECURITY MEASURES DOES GDPR ARTICLE 32 SPECIFICALLY REFERENCE?

5.1 WHAT DOES ARTICLE 32 SAY ABOUT ENCRYPTION AND PSEUDONYMISATION?

Article 32 explicitly references pseudonymisation and encryption of personal data as example measures appropriate to the risk, without mandating them universally for every type of processing. Where personal data is encrypted to an appropriate standard and the encryption key is not compromised alongside the data itself, the ICO’s breach assessment guidance recognises that the practical risk to individuals, and therefore the breach notification threshold, may be reduced, though encryption alone does not eliminate the obligation to assess and respond to an incident.

5.2 WHAT DOES ARTICLE 32 SAY ABOUT ONGOING CONFIDENTIALITY, INTEGRITY, AND AVAILABILITY?

Article 32 requires organisations to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, language that maps directly onto established cybersecurity principles and which regulators interpret as requiring continuous security management rather than a one-off implementation. This is the specific regulatory hook that makes structured, recurring penetration testing, cloud security assessment, and incident response capability directly relevant to demonstrable Article 32 compliance, rather than simply good general practice.

5.3 WHAT DOES ARTICLE 32 SAY ABOUT TESTING AND EVALUATING SECURITY MEASURES?

Article 32 specifically requires a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing. This is not an implicit inference. It is an explicit, named obligation, meaning a UK organisation processing personal data without any structured security testing programme is failing a specific, written requirement of the regulation, not simply falling short of an industry best practice recommendation.

5.4 HOW DOES A DATA PROTECTION IMPACT ASSESSMENT RELATE TO CYBERSECURITY TESTING?

A Data Protection Impact Assessment is required under UK GDPR for processing activities likely to result in high risk to individuals, and forms a structured process for identifying and mitigating data protection risks before processing begins. Where new systems, applications, or significant changes are introduced, security testing findings, including penetration testing and secure code review results, frequently form direct, citable evidence within the DPIA documentation, demonstrating that technical risks have been identified and addressed as part of the assessment process. ICO guidance on DPIAs is at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/.

🔎 6. HOW DOES PENETRATION TESTING SUPPORT GDPR COMPLIANCE?

6.1 HOW DOES REGULAR PENETRATION TESTING SATISFY THE ARTICLE 32 TESTING OBLIGATION?

Regular penetration testing provides direct, documented evidence that an organisation has implemented the testing and evaluation process Article 32 specifically requires. Oracle Mobile Security penetration testing services follow NIST SP 800-115 at https://www.nist.gov/publications/technical-guide-information-security-testing-and-assessment, covering network infrastructure, web applications, APIs, and cloud environments, producing risk-ranked findings reports that an organisation can point to directly as evidence of the structured evaluation process the regulation describes.

6.2 HOW DOES SECURE CODE REVIEW SUPPORT GDPR COMPLIANCE FOR ORGANISATIONS BUILDING CUSTOM SOFTWARE?

Organisations developing custom software that processes personal data carry a specific obligation under the data protection by design and by default principle in Article 25, requiring privacy and security considerations to be embedded into systems from the design stage rather than retrofitted afterward. Oracle Mobile Security secure code review services, examining codebases against the OWASP Top 10 at https://owasp.org/www-project-top-ten/ using manual review combined with automated static analysis, provide the technical evidence base that supports a defensible data protection by design position.

6.3 HOW DOES CLOUD SECURITY ASSESSMENT RELATE TO GDPR OBLIGATIONS FOR CLOUD-HOSTED PERSONAL DATA?

Where personal data is hosted in cloud environments, the controller’s Article 32 security obligations extend to that infrastructure regardless of the shared responsibility model the cloud provider operates under. Oracle Mobile Security cloud security assessment services evaluate AWS, Azure, and Google Cloud Platform environments against CIS Benchmarks at https://www.cisecurity.org/cis-benchmarks/, identifying the specific misconfigurations, including exposed storage and over-permissioned access, that most frequently result in the reportable personal data breaches regulators see most often.

6.4 HOW DOES RED TEAMING DEMONSTRATE GDPR-RELEVANT DETECTION AND RESPONSE CAPABILITY?

Beyond identifying vulnerabilities, Article 32 compliance increasingly requires organisations to demonstrate genuine detection and response capability, not simply theoretical controls. Oracle Mobile Security red team operations, mapped to the MITRE ATT&CK framework at https://attack.mitre.org, test whether an organisation’s actual detection and response process would identify and contain a realistic attacker targeting personal data, providing evidence directly relevant to regulators assessing whether security measures were genuinely appropriate to the risk, rather than merely documented on paper.

🚨 7. HOW SHOULD AN ORGANISATION RESPOND IMMEDIATELY AFTER DISCOVERING A BREACH?

7.1 WHAT ARE THE FIRST STEPS AN ORGANISATION SHOULD TAKE IN THE HOURS AFTER DISCOVERING A SUSPECTED BREACH?

The hours immediately following discovery of a suspected breach are the most consequential of the entire incident, both technically and legally. The appropriate immediate sequence includes:

1. Containing the incident to prevent further data loss or system compromise, without destroying evidence needed for subsequent investigation
2. Engaging incident response specialists to assess the scope and nature of the compromise
3. Beginning the internal record of facts and decisions, since this documentation will be required for the ICO notification and may be scrutinised in any subsequent enforcement review
4. Assessing, with appropriate technical and legal input, whether the incident constitutes a personal data breach requiring notification, and if so, whether the high-risk threshold for direct individual notification is also met
5. Preparing the ICO notification within the 72 hour window where notification is required, even where complete information is not yet available

7.2 HOW DOES ORACLE MOBILE SECURITY SUPPORT THE INCIDENT RESPONSE PHASE OF A GDPR-RELEVANT BREACH?

Oracle Mobile Security incident response specialists work continuously to isolate compromised systems, eradicate attacker persistence mechanisms, and restore business continuity, following the NIST incident response framework at https://www.nist.gov/cyberframework. Critically for GDPR purposes, every incident response engagement produces forensic documentation following NIST SP 800-101 at https://www.nist.gov/publications/guidelines-mobile-device-forensics, establishing exactly what data was affected, how the compromise occurred, and what containment measures were taken, all of which forms essential supporting evidence for the ICO notification and any subsequent regulatory engagement.

7.3 WHY IS FORENSIC DOCUMENTATION SO IMPORTANT TO THE REGULATORY DEFENCE OF A BREACH?

A breach notification that states personal data may have been affected, without precise, evidenced detail of what occurred, how, and when, leaves an organisation in a significantly weaker regulatory position than one supported by hash-verified forensic evidence establishing the precise scope of compromise. Forensic documentation produced to NIST SP 800-101 standard does not just support the immediate notification. It becomes the evidential foundation the organisation relies on throughout any subsequent ICO investigation, civil claim, or insurance process.

7.4 WHAT ROLE DOES MOBILE AND DEVICE FORENSICS PLAY IN A GDPR BREACH INVESTIGATION?

Where a breach originates from or involves a compromised mobile device, such as a lost company phone or a successful phishing attack against an employee, Oracle Mobile Security certified forensic analysts conduct device forensic analysis following NIST SP 800-101, establishing precisely what personal data the device had access to and whether that data was actually accessed or exfiltrated, a distinction that frequently determines whether the breach notification threshold has genuinely been met.

🏢 8. WHAT INDUSTRY-SPECIFIC GDPR AND CYBERSECURITY CONSIDERATIONS APPLY?

8.1 WHAT ADDITIONAL OBLIGATIONS APPLY TO FINANCIAL SERVICES FIRMS?

UK financial services firms carry GDPR obligations alongside FCA operational resilience and cybersecurity expectations at https://www.fca.org.uk, with the regulator increasingly expecting demonstrable, CREST-aligned penetration testing and incident response capability as part of broader regulatory supervision, in addition to the data protection obligations that apply to all sectors equally.

8.2 WHAT ADDITIONAL OBLIGATIONS APPLY TO HEALTHCARE AND NHS-CONNECTED ORGANISATIONS?

Healthcare organisations and NHS-connected entities carry GDPR obligations alongside the specific cyber security standards published by NHS Digital at https://digital.nhs.uk/cyber-and-data-security, reflecting the particularly sensitive category of health data involved and the elevated risk to individuals where such data is compromised.

8.3 WHAT ADDITIONAL OBLIGATIONS APPLY TO LEGAL AND PROFESSIONAL SERVICES FIRMS?

Legal and professional services firms hold both GDPR obligations and professional confidentiality duties referenced by the Solicitors Regulation Authority at https://www.sra.org.uk, meaning a data breach affecting client information frequently triggers both regulatory notification obligations and separate professional conduct considerations that operate alongside, rather than instead of, the GDPR framework.

8.4 DO THESE OBLIGATIONS DIFFER FOR ORGANISATIONS OPERATING ACROSS THE UK AND US?

Yes. US organisations are not subject to UK GDPR for processing that falls outside its territorial scope, but frequently face an equivalent patchwork of state-level breach notification laws, alongside sector-specific obligations and CISA reporting requirements at https://www.cisa.gov/report for significant cyber incidents. Organisations operating across both jurisdictions, including Oracle Mobile Security’s own UK and US client base, require security testing and incident response capability structured to satisfy both regulatory frameworks simultaneously, rather than treating either as the default standard.

⚙️ 9. HOW DOES THE ORACLE MOBILE SECURITY ENGAGEMENT PROCESS WORK?

9.1 HOW DO I START THE PROCESS OF ENGAGING ORACLE MOBILE SECURITY FOR GDPR-RELATED CYBERSECURITY SUPPORT?

1. Step 1: Confidential Assessment. Every case begins with a free, confidential consultation. You describe your current security testing programme, your processing activities, and whether you are responding to an active incident or strengthening compliance proactively. Oracle Mobile Security provides a direct, honest recommendation based on your organisation’s specific risk profile.
2. Step 2: Written Service Agreement. Oracle Mobile Security does not begin work without a signed written service agreement documenting the exact scope, cost structure, deliverables, and timeline. Active incident engagements are prioritised given the 72 hour notification clock.
3. Step 3: Precision Execution. Engagements are executed by CEH and OSCP certified practitioners using methodologies aligned to OWASP at https://owasp.org, NIST at https://www.nist.gov, and MITRE ATT&CK at https://attack.mitre.org.
4. Step 4: Documented Delivery. Clients receive risk-ranked findings reports, forensic documentation where applicable, and clear recommendations on the evidential basis they can present to the ICO or other regulators.

9.2 HOW MUCH DOES IT COST TO ENGAGE ORACLE MOBILE SECURITY FOR GDPR-RELATED INCIDENT RESPONSE OR TESTING?

Cost varies depending on whether the engagement is proactive testing or active incident response, the scope of systems affected, and the complexity of the environment. Oracle Mobile Security provides a clear, fixed-scope cost structure in the written service agreement before any commitment is made. Cost is discussed transparently during the free initial consultation. The full services overview is at https://www.oraclemobilesecurity.com/services-professional-ethical-hackers/.

🌍 10. WHERE DOES ORACLE MOBILE SECURITY OPERATE?

10.1 IS ORACLE MOBILE SECURITY AVAILABLE FOR ORGANISATIONS BASED IN THE USA?

Yes. Oracle Mobile Security maintains active engagement capacity across the United States and internationally from its UK headquarters. The team operates within US federal law, state-level cybercrime legislation, and the Computer Fraud and Abuse Act at https://www.law.cornell.edu/uscode/text/18/1030. US organisations can report cyber incidents to CISA at https://www.cisa.gov.

10.2 IS ORACLE MOBILE SECURITY CERTIFIED AND REGULATED?

Oracle Mobile Security practitioners hold the Certified Ethical Hacker credential from the EC-Council, verifiable at https://www.eccouncil.org, and the Offensive Security Certified Professional credential from Offensive Security, verifiable at https://www.offsec.com. Technical methodology follows the NIST Cybersecurity Framework at https://www.nist.gov/cyberframework, OWASP standards at https://owasp.org, and the MITRE ATT&CK framework at https://attack.mitre.org. UK data protection obligations are governed by the ICO at https://ico.org.uk.

❓ 11. FREQUENTLY ASKED QUESTIONS: GDPR AND CYBERSECURITY

11.1 DOES EVERY DATA BREACH HAVE TO BE REPORTED TO THE ICO?

No. Only breaches likely to result in a risk to the rights and freedoms of individuals require notification. A breach assessed as genuinely unlikely to cause such risk, with that assessment properly documented, does not require ICO notification, though the organisation must still record the breach internally regardless of whether notification is required.

11.2 CAN I HIRE A HACKER FOR A DATA BREACH INVESTIGATION TO HELP MEET MY GDPR OBLIGATIONS?

Yes. Engaging certified incident response and forensic specialists to investigate a suspected breach is both lawful and frequently essential to producing the evidenced, accurate notification UK GDPR requires. Oracle Mobile Security conducts every engagement under a signed service agreement, with credentials independently verifiable at https://www.eccouncil.org and https://www.offsec.com.

11.3 WHAT IS THE DIFFERENCE BETWEEN UK GDPR AND EU GDPR FOR A BUSINESS OPERATING IN BOTH MARKETS?

Following the UK’s withdrawal from the EU, UK GDPR and EU GDPR are now separate, though closely aligned, legal regimes. A UK business processing the personal data of EU residents may need to comply with both frameworks simultaneously, including potentially appointing an EU representative, while a business operating only within the UK is governed by UK GDPR and the Data Protection Act 2018 alone.

11.4 HOW OFTEN SHOULD AN ORGANISATION CONDUCT PENETRATION TESTING TO REMAIN GDPR COMPLIANT?

UK GDPR does not specify a fixed testing frequency, since the appropriate frequency is risk-based. Most organisations processing meaningful volumes of personal data conduct comprehensive penetration testing at least annually, with additional testing following significant infrastructure changes, new system deployments, or after any security incident, in order to maintain a defensible, continuously evidenced testing programme.

11.5 CAN A SMALL BUSINESS BE FINED THE FULL MAXIMUM GDPR PENALTY?

In practice, the ICO calibrates fines to the severity of the infringement and the size and resources of the organisation involved, meaning the maximum penalty figures are reserved for the most serious cases involving larger organisations or particularly severe negligence. However, small businesses are not exempt from enforcement entirely, and proportionate fines, alongside the reputational and operational consequences of a poorly handled breach, remain a genuine risk regardless of organisational size.

🎯 12. PRECISION STARTS WITH A CONVERSATION: BOOK YOUR FREE CONSULTATION TODAY

GDPR and cybersecurity are not two separate considerations sitting alongside each other. They are the same obligation, viewed from a legal angle and a technical angle, and a defensible compliance position requires both to be addressed together, before a breach occurs and immediately after one is discovered. Oracle Mobile Security supports UK and international organisations through both halves of that obligation.

The first step costs nothing. A free, confidential consultation with a qualified Oracle Mobile Security specialist will assess your organisation’s specific risk profile and current testing programme honestly, explain directly what is appropriate, and outline exactly what an engagement would involve, without obligation, without pressure, and without any payment request before a written agreement is in place.

When precision matters, it matters from the first contact.

To begin a free confidential consultation, visit https://www.oraclemobilesecurity.com/contact-us/

Explore the full service range at https://www.oraclemobilesecurity.com/services-professional-ethical-hackers/

Learn about the certified ethical hacking team at https://www.oraclemobilesecurity.com/about-certified-ethical-hackers/

Browse further cybersecurity resources at https://www.oraclemobilesecurity.com/blog/

Return to the Oracle Mobile Security homepage at https://www.oraclemobilesecurity.com/

🔎 13. KEY TAKEAWAYS: GDPR AND CYBERSECURITY

Before assessing your organisation’s current compliance position, keep these points in mind:

1. UK GDPR Article 32 imposes specific, enforceable security obligations, not general best practice aspirations
2. A qualifying personal data breach must be reported to the ICO within 72 hours of becoming aware of it
3. Fines for serious infringements can reach seventeen and a half million pounds or four percent of global turnover
4. Regular security testing, including penetration testing and secure code review, provides direct evidence of Article 32 compliance
5. Forensic documentation of a breach is essential to a defensible regulatory notification and any subsequent enforcement review
6. GDPR and cybersecurity obligations apply equally regardless of organisational size, though enforcement is calibrated to severity and resources

Oracle Mobile Security supports organisations through both proactive compliance testing and active breach response. Real professional hackers for hire are professionals first.