The obligation to provide appropriate technical and organisational (security) measures for Personal Data applies to both Controllers and Processors. The DPR do not specify any particular security measures, rather it is up to the organisation to judge what is appropriate in the circumstances taking into account:

• the state of the art (i.e. the current state of technological development as appropriate to the context including: industry practice; the type and scale of the Processing; and the availability of a product or solution in the market);
• the costs of implementation;
• the nature, scope, context and purposes of the Processing; and
• the likelihood and severity of risks to Data Subjects’ rights (in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data).

Controllers must only use Processors that can give sufficient guarantees they will implement appropriate technical and organisational measures to ensure their Processing will meet the requirements of the DPR and protect Data Subjects’ rights. Controllers are primarily responsible for overall compliance with the DPR, and for demonstrating that compliance. If this isn’t achieved, they may be liable to pay damages in legal proceedings or be subject to fines or other penalties or corrective measures (see “Enforcement” below).