The GDPR requires technical and organizational measures appropriate to the risk to protect data: access control, encryption, pseudonymization, logging, backups, staff awareness. It aims at confidentiality, integrity and availability. The expected level depends on the sensitivity and the context.
Example
Encrypt exports containing personal data.