GDPR Compliance with Offline Secure Storage
GDPR Article 32 requires 'appropriate technical and organisational measures.' Offline Secure Storage (OSS) provides physical disconnection, the strongest technical measure available.
We Think This Is Hard to Ignore
The ICO issued £14 million in fines to a single firm for failing to implement appropriate technical measures. At Firevault, personal data lives on hardware with no network connection, because Article 32 requires appropriate measures and physical disconnection is the strongest one available.
£14M
ICO fine to Capita for GDPR failures
ICO, October 2025
£1.2M
ICO fine to LastPass for data protection failures
ICO, December 2025
36,049
Data protection complaints received by ICO in 2024
ICO Annual Report 2024
6.5M
People affected by single Co-op data breach
BBC News, 2025
Where current approaches fall short.
Most organisations rely on encryption and access controls alone. These are necessary but insufficient.
Encryption Is Not Enough
Encrypted data is still reachable, still targetable, and still at risk of key compromise.
Article 32 Demands More
'Appropriate measures' must be proportional to risk, for sensitive data, physical protection is expected.
ICO Expectations
The ICO increasingly expects demonstrable physical security measures for high-risk processing.
GDPR enforcement is accelerating.
Capita: £14M Fine for Failing to Secure Personal Data
The ICO issued a combined £14 million fine to Capita for failing to implement appropriate technical measures under GDPR, after hackers accessed personal data of over 6 million people.
ICO, October 2025
LastPass: £1.2M Fine After 1.6 Million UK Users Exposed
The ICO fined LastPass £1.2 million for GDPR failures that allowed hackers to steal personal information of 1.6 million UK customers. The ICO described the security measures as unacceptable.
ICO, December 2025
Co-op: 6.5 Million Members' Data Stolen
Attackers exfiltrated personal data of all 6.5 million Co-op members. The ICO opened an investigation into whether appropriate technical measures were in place under Article 32.
BBC News, 2025
Physical disconnection as an appropriate measure.
Offline Secure Storage (OSS) directly satisfies GDPR Article 32 by providing physical technical measures.
- Physical disconnection, the strongest technical measure available
- Full audit trail for accountability requirements
- Data minimisation through controlled access sessions
- Integrity and confidentiality through tamper-evident storage
Take Personal Data Off Connected Systems
Step 1 of 3Personal data is taken off always-connected systems and written to physically disconnected RAID 1 drives inside a Firevault Bunker. Data that is not online cannot be breached, scraped, or exfiltrated remotely.
Featured In
Win Business, Earn Trust, and Build Reputation with Butterfly
Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.
Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.
Deal Readiness
Governed materials ready to share with confidence
Client Trust
Demonstrate stewardship that earns loyalty
Board Confidence
Clear governance that inspires stakeholders
Enterprise Scale
Structure data governance across your organisation
Who Uses Butterfly?
-
Sales Teams
Secure client proposals, pricing, and commercial intelligence
-
Service Providers
Exchange sensitive documents with clients through governed Vaults
-
Businesses
Protect strategic plans, IP, and competitive intelligence
-
Family Offices
Structure data governance across principals, staff, and advisors
Questions
Frequently Asked
CAF-aligned
Mapped to CAF outcomes, not certified against CAF.
Firevault is not certified against the NCSC Cyber Assessment Framework. CAF is a self-assessment framework for essential service operators. The sections below show how our products help you evidence CAF outcomes in your own submission.
Offline Secure Storage and CAF
Using Offline Secure Storage supports CAF Objective B (Protecting against cyber attack) and Objective D (Minimising the impact of incidents). Gold copies live on hardware that is physically disconnected between sessions, giving operators evidence of protective isolation and a recoverable state.
Supports outcomes
Taking Control, deploying Blueprints and CAF
Deploying a Control Blueprint supports CAF Objective A (Managing security risk) and Objective C (Detecting cyber security events). Blueprints document identity-verified access, session logging and segregation between operational and archived data, so the controls can be pointed at CAF outcomes in a self-assessment.
Supports outcomes
Deploying Firebreak and CAF
Deploying Firebreak supports CAF Objective B (Protecting against cyber attack) at the network boundary of operational technology environments. Firebreak enforces physical-layer separation between OT and IT, giving CNI operators evidence of controlled paths for CAF network security outcomes.
Supports outcomes
Firevault maps controls to CAF outcomes to help essential service operators evidence their own self-assessment. Full mapping detail is available on request.