S.L. 595.18 Art. 11Appropriate safeguards.

(1) The Agency, while taking into account the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, both at the time of the determination of the means for processing as well as at the time of the processing itself, shall implement appropriate technical and organisational measures, in an effective manner and integrate the necessary safeguards into the processing in order to protect the rights of the data subjects and to ensure a level of security appropriate to the risk.

(2) The data protection officer designated by the Agency in accordance with Article 37(1)(a) of Regulation (EU) 2016/679 shall be involved and consulted properly and in a timely manner on all matters in relation to the protection of personal data processed for the purposes of this order.

(3) For the purposes of ensuring and to be able to demonstrate that the processing of personal data is performed in accordance with the provisions of Regulation (EU) 2016/679, the Agency shall implement the appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.