Cap. 640 Art. 32Adequate protection measures.

(1) The Authority shall implement those appropriate technical and organised measures to ensure an adequate level of security which is appropriate to the risk posed, and in particular to prevent unauthorized disclosure of or unlawful access to information pertaining to data subjects. In the implementation of the mentioned measures the nature, scope, context and purposes of the processing shall be considered.

(2) The data protection officer designated by the controller in terms of Article 37 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) shall be involved and consulted properly and in a timely manner on all issues in relation to the protection of personal data processed for the purposes of this Act.

(3) For the purpose of ensuring and in order to be able to demonstrate that the processing of personal data is performed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the controller shall implement all appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.