Data controllers and processors must implement appropriate technical and organizational measures to ensure an appropriate level of security in the processing of personal data. These measures include, but are not limited to:

• The de-identification and / or encryption of the personal data;
• Ability to ensure continuing confidentiality, integrity, availability and resilience of processing systems and advances;
• Ability to restore availability of and access to the personal data in a timely manner if a physical or technical incident has occurred;
• A process for routinely testing, assessing and evaluation the effectiveness of the measures.

The measures implemented ought to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected and in particular, to protect such personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the personal data. In assessing what measures are appropriate, data controllers and processors can consider:

• Availability of technology;
• Costs of implementation;
• The processing activities; and
• The likelihood and severity of the risks to the rights and legitimate interests of individuals.