The DP Act regulates security measures on integrity of personal information processed by a data controller and security measures regarding information processed by an agent.

The DP Act (section 20) gives the data controller the duty to secure the integrity of personal information in its possession by taking appropriate measures to prevent the loss, damage to or unauthorised destruction of personal information and prevent the unlawful access to or processing of personal information.  In order to give effect to this, the data controller should take the following reasonable measures:

• Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
• Establish and maintain appropriate safeguards against the identified risks;
• Regularly verify that the safeguards are effectively implemented; and
• Ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.  

The DP Act (section 21) states that any personal information processed by an agent should only be done with the knowledge and authorization of the data controller.  Secondly the personal information should be treated as confidential unless the law or the performance of their duties requires disclosure.  The following security measures are in place for information processed by an agent:

• A data controller should ensure that the agent processing the personal information establishes and maintains the security measures referred to in the DP Act.
• A written contract between the data controller and agent governs the processing of personal information by the agent.
• If the agent is not domiciled or does not have its principal place of business in Lesotho, the data controller should take reasonable steps to ensure that the agent complies with the laws relating to the protection of personal information of the territory in which the agent is domiciled.