GDPR requires appropriate technical measures around access to personal data. Securing the network that access happens over is one such measure, and a documentable one.