The important points here are “Taking into account the state of the art” and “appropriate technical and organisational measures to ensure a level of security ap

The important points here are “Taking into account the state of the art” and “appropriate technical and organisational measures to ensure a level of security appropriate to the risk”. For example, this case is cited in the page linked above: https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_DI-2021-4355 https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_DI-2021-43... > Sending an e-mail containing sensitive data with enforced TLS-encryption instead of end-to-end encryption was deemed insufficient secured under Article 32(1) GDPR.