{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":7,"total":7,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/gdpr/articles/32","url":"https://www.headlesslaw.com/gdpr/articles/32","title":"Article 32 — Security of processing","work_id":"gdpr","date_state":"current","as_of":"2026-11-02","relations_url":"https://www.headlesslaw.com/gdpr/articles/32/relations"},"as_of":"2026-11-02","counts":{"refers_to:out":2,"refers_to:in":4,"guides:in":1},"relations":[{"edge_id":"67482ea2305bd99bc8c4","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/40","url":"/gdpr/articles/40","title":"Codes of conduct","key":"40","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.32","source_block_id":"eu.gdpr.article.32.paragraph.3"}},{"edge_id":"faa68cedfc829d0f53d6","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 42","dst_raw":"eu.gdpr.article.42","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/42","url":"/gdpr/articles/42","title":"Certification","key":"42","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.32","source_block_id":"eu.gdpr.article.32.paragraph.3"}},{"edge_id":"34a5d56ef051ebd2873f","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32(1)","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/30/para/1/pt/g","url":"/gdpr/articles/30#p-1-g","title":"Records of processing activities","key":"30(1)(g)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.30","source_block_id":"eu.gdpr.article.30.paragraph.1.point.g"}},{"edge_id":"7bacc8232dbfd80a6740","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/28/para/3/pt/c","url":"/gdpr/articles/28#p-3-c","title":"Processor","key":"28(3)(c)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.3.point.c"}},{"edge_id":"c3b725e3b3a08c167dd4","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/40/para/2/pt/h","url":"/gdpr/articles/40#p-2-h","title":"Codes of conduct","key":"40(2)(h)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.40","source_block_id":"eu.gdpr.article.40.paragraph.2.point.h"}},{"edge_id":"f72d7c25580aef3ba626","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32(1)","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/30/para/2/pt/d","url":"/gdpr/articles/30#p-2-d","title":"Records of processing activities","key":"30(2)(d)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.30","source_block_id":"eu.gdpr.article.30.paragraph.2.point.d"}},{"edge_id":"c602b0065fba48c17ea3","scope":"unit","type":"guides","direction":"in","resolution":"resolved","basis":"curated_edge_tsv","method":"bl21-edge-tsv","confidence":"curated","src_from":"2025-01-16","src_until":null,"span":null,"dst_raw":"eu.gdpr.article.32","other":{"work_id":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","level":"L3","locator":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation/page","url":"/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","title":"Guideline — Pseudonymisation [consultation]","key":"EDPB 01/2025","state_on_date":"in_force"},"evidence":{"tsv":"_research/coverage/bl21-l1-l2l3-edges.tsv","row":381,"evidence":"legal_basis: Articles 4(5), 25 and 32 GDPR","doc_type":"guideline"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}