What it asks for. Controllers and processors must put in place technical and organisational measures that give a level of security appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing. The article names examples such as pseudonymisation, encryption, resilience, the ability to restore availability and regular testing of the measures.
In practice. Organisations base their controls on a documented risk assessment of each processing activity rather than a generic checklist. Typical evidence includes access control and encryption standards, backup and restore tests, vulnerability management records and results of periodic security testing. Processors are expected to show the same discipline for the data they handle on a controller's behalf.
Common gaps. Measures are often chosen once and never revisited as risks change. Testing and evaluating effectiveness, which the article explicitly mentions, is frequently missing or undocumented.