According to Article 71 of the Protection of Personal Data, all data controllers have an obligation to ensure the security of personal data.  The data controller is required to take all necessary precautions with regard to the nature of the data and, in particular, to prevent it from being distorted, damaged, or unauthorized third parties having access to it. Data Controllers must make sure that:

• authorized persons can only access data personal nature within their competence;
• the identity and interests of any third parties recipients of the data can be verified;
• identity of persons having access to the information system can be verified;
• unauthorized persons are prevented from accessing  the place and equipment used for data processing;
• unauthorized persons are prevented from reading; coping; modifying, moving and destroying data;
• all data introduced in the system is authorized;
• Data will not be read, copied, modified or erased without authorization during the transport or communication of the data.
• Data is backed up with security copies;
• Data are renewed and converted to preserve them.