“Shall” is a legal term that means obligation, not choice. In security and privacy rules, it tells an organization that a duty must be met, even if the law does not prescribe one exact technical method. In GDPR language, this turns principles such as protection, minimization, and accountability into required action.
In cyber security, that matters because defenders must translate a legal duty into real controls: access restrictions, logging, encryption, retention limits, and response processes. Attackers do not exploit the word itself, but they benefit when organizations treat “shall” as vague wording instead of a binding requirement. Good defenses treat it as a design constraint: identify the duty, choose suitable measures, document the decision, and verify that the protection works in practice.