The GDPR’s state of the art is a reference term - decoupled from fixed technical and organizational standards at a given time. Therefore, it is vital to define how requirements should be methodically derived from the state of the art, as stating no hint in the regulation led to insecurities amongst the GDPR’s addressees. This article presents an approach from the German IT association TeleTrust which can help companies to reduce their insecurities. The problems with the state of the art in the effort saver digital world are shown on the example of identification and consent.
