S.L. 586.9 Art. 5Safeguards and retention periods.

(1) Personal data that is subject to a restriction referred to in regulation 4 shall not be subject to processing that is incompatible with the purposes for which such data was collected, unless provided for by law or with the explicit consent of the data subject.

(2) The data controller shall, pursuant to Article 32 of the Regulation, implement appropriate technical and organisational measures to protect personal data processed pursuant to these regulations against accidental destruction or loss or unlawful forms of processing.

(3) The retention period to be applied for personal data that are processed pursuant to these regulations, shall not be longer than what is necessary for the purpose of the processing of such personal data or shall not be longer than the period required to achieve the aim of the restriction, or as provided by law.