Explore the complexities of GDPR's information security requirements in this 40-minute conference talk from RSA Conference. Delve into the concept of 'appropriate' technical and organizational measures for ensuring personal data protection. Learn how to interpret Article 32's guidance on factors like cost, risk, state of the art, scope, and purpose to determine what's suitable for your organization. Gain insights into regulatory perspectives and develop a framework for assessing and implementing appropriate security measures. Understand the impact of variables such as implementation costs, risk levels, and fundamental rights on security decisions. Discover how to create a good security baseline, calculate risks, and adapt to changing appropriateness standards. Equip yourself with the knowledge to navigate GDPR compliance effectively and confidently justify your organization's security approach to regulators.