The data processor must present sufficient guarantees to ensure the security and confidentiality of personal data. This requirement does not relieve the data controller of its obligation to ensure compliance with the measure concerning security and confidentiality displayed in Articles 113 et seq. of the Personal Data Act 2023.

The obligations of data controllers include:

• Transparency: The data controller must inform the data subject of the terms of processing when the data is not collected from the data subject. In addition, the data controller must inform the data subject at least before the first communication and must also guarantee a lawful basis to carry out the processing operation;
• Confidentiality: The data controller must assure that the processing of personal data is only carried out under his authority and instructions. In addition, the data controller must guarantee that only individuals who have technical and legal knowledge regarding the integrity of data, and in this sense the data controller must ensure that the individuals dealing with personal data has signed a non-disclosure agreement;
• Security: The data controller is required to take any appropriate precautionary measures in regard to the nature of personal data, and, in particular, the data controller shall prevent personal data from being distorted, damaged, or unauthorised access by third parties. In particular, the data controller must: 
  
  • create different levels of access permissions, on a need-to-know basis depending on the position of its employees, thus avoiding unauthorised actions;
  • use encryption or pseudonymisation; 
  • keep a record of who accesses the personal data, when and why, ensuring traceability of its use; 
  • maintain backups in secondary sources to prevent accidental changes or loss of data; and
  • ensure the identity of the person who wants to access the data or the identity of the parties to whom the data will be disclosed;
• Retention: The data controller must guarantee that the data is kept for no longer than the purpose for which was collected.

The Data Protection Law expressly provides for limited data controller rights, and in practice provides data controllers with the right to: 

• process personal data in the conditions provided for by law; 
• refuse compliance with unreasonable requests and demands from data subjects; and 
• appeal any sanctioning decisions by the APDPVP before the State Counsel.

By contrast, the data subject are entitled to the following rights provided for in Articles 52 and 53 of the aforementioned Personal Data Act 2023:

• obtain all of their personal data in an understandable form, as well as any available information as to the origin;
• oppose, for legitimate reasons, the processing of personal data concerning them;
• oppose the processing of their personal data for prospecting purposes;
• rectify, complete, update, lock, or delete personal data concerning them, where it is inaccurate, incomplete, equivocal, out of date, or if collection, use, communication or conservation is prohibited; and
• not be subject to decisions made on the sole basis of an automated processing that would produce significant or detrimental legal repercussions for them.

Interconnection of personal data shall:

• not discriminate against or infringe on the fundamental rights, freedoms, and guarantees of holders of the data;
• ensure the use of appropriate safety measures; and
• take into account the principle of relevance (Article 169 of the Personal Data Act 2023).