GDPR Article 32 — Security of processing

Note: this explainer is informational and framework references are never a compliance guarantee — align your program with your legal counsel.

What Article 32 requires

Controllers and processors must implement appropriate technical and organizational measures for a level of security appropriate to the risk — considering the state of the art and the likelihood and severity of harm. Article 32 is deliberately technology-neutral: when a new data-exfiltration channel appears, "appropriate measures" extends to it.

What it means for your company

The browser-to-AI channel is exactly such a channel: credentials pasted into a chatbot, customer data in a prompt, proprietary code shared for a quick review. Firewalls and DLP for email don't see it. If personal data can leave through AI tools unprotected, your Article 32 measures have a documented gap.

How Shield operationalizes it

Three starter presets are referenced to Art. 32 and cover the channel in depth:

• Block secrets & credentials — API keys, tokens, and private keys never reach any AI tool.
• Transform PII / Transform financial data — personal and financial data is redacted on the device before submission.
• Warn on source code sharing — an awareness measure for material that is sensitive but sometimes legitimately shared.

All are active in every new organization from the first minute, and every enforcement event is recorded in the audit log.

The outcome

The AI channel appears in your Article 32 documentation as a covered channel: named measures, state-of-the-art on-device detection, and an evidence trail — instead of an open flank discovered during the next audit.