Section 66 — Data Protection Act 2018: Security of processing

Security of processing 66 1 Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.

2 In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

a prevent unauthorised processing or unauthorised interference with the systems used in connection with it, b ensure that it is possible to establish the precise details of any processing that takes place, c ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and d ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

3 Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).