TOMs
Technical and organizational measures under Art. 32 GDPR – with evidence instead of assertion.
Most TOM documents are collections of intentions: "access is restricted", "data is encrypted". That is of little use in an audit. SimpleAct structures the measures along the nine Art. 32 categories and asks for an implementation status, evidence, and – where it makes sense – links to the processing activities and vendors the measure actually covers.
At a glance
- Included from
- Professional
- Where in the app
- Data protection → TOMs
- Output
- A measures catalogue with implementation status and evidence
- Legal basis
- Art. 32 GDPR
- API
- /api/v1/toms
The nine categories
The catalogue is identical for every organization. You can have it seeded as a starting skeleton – only missing categories are added, existing entries are left untouched.
| Category | Typical measures |
|---|---|
| Access control | Role and permission concept, multi-factor authentication, building access, recertification of permissions. |
| Encryption | Transport and disk encryption, key management, handling of backups. |
| Integrity | Input control, change logging, protection against undetected manipulation. |
| Availability | Redundancy, monitoring, capacity planning, protection against outages. |
| Recovery | Backup concept, recovery times, tested restores. |
| Testing and evaluation | Penetration tests, internal audits, regular effectiveness reviews of the measures. |
| Pseudonymization | Separation of identifiers and payload data, handling of mapping tables. |
| Confidentiality | Confidentiality obligations, separation requirements, transfer controls. |
| Organizational measures | Policies, responsibilities, training, processes for incidents and data subject rights. |
Implementation status
Four levels, the same as the EU AI Act controls. The step from "implemented" to "evidenced" is the one that counts in an audit.
| Status | Meaning |
|---|---|
| NOT_STARTED | Measure named, but not started. |
| IN_PROGRESS | Being implemented. |
| IMPLEMENTED | Implemented – but with no stored proof. |
| EVIDENCED | Implemented and backed by evidence: policy, test report, configuration excerpt, certificate. |
What holds a measure together
- Title and description – what is actually done, not what is intended.
- Evidence links – references to the proof. Several links per measure are possible.
- Linked processing records – which processing activities this measure covers. That answers the authority’s question "which measures protect this processing?" without research.
- Linked vendors – which processors the measure applies at.
- Date of the last review – Art. 32 requires regular effectiveness reviews, not one-time setup.
The seeded skeleton is a start, not a result
The nine seeded categories are empty shells with the right label. A category with no description and no evidence is no better in an audit than a missing one – it just looks tidier. Take the time to store at least one concrete measure with proof per category.