GDPR Article 32 - Security of processing

Article 32(1) requires measures appropriate to risk 'taking into account the state of the art, the costs of implementation' - cost is an explicit input to the adequacy judgement, which is why a KV-cache isolation argument has to quantify its throughput cost. 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of those measures. 32(4) requires that any natural person with access to personal data does not process it except on the controller's instructions - i.e. operators and support staff are inside the control.