The PIC must implement reasonable and appropriate organizational, physical and technical measures to protect Personal Information against any type of accidental or unlawful destruction, such as from accidental loss, unlawful access, fraudulent misuse, unlawful destruction, alteration, contamination and disclosure, as well as against any other unlawful processing.

The determination of the appropriate level of security must take into account the nature of the Personal Information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation.

In addition, the security measures to be implemented must include the following, which are subject to guidelines that the NPC may issue:

• safeguards to protect its computer network against accidental, unlawful or unauthorized usage or interference with or hindering of their functioning or availability; 
• a security policy with respect to the processing of Personal Information; 
• a process for identifying and accessing reasonably foreseeable vulnerabilities in its computer networks, and for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach; and 
• regular monitoring for security breaches and a process for taking preventive, corrective and mitigating action against security incidents that can lead to a security breach.

The PIC is obligated to ensure that third parties processing Personal Information on its behalf shall implement the security measures required by the Act.

The obligation to maintain strict confidentiality of Personal Information that are not intended for public disclosure extends to the employees, agents or representatives of a PIC who are involved in the processing of such Personal Information.