Technical and organisational measures under Art. 32 GDPR: access control, encryption, EU hosting, availability, resilience and regular review cycles.