Data Controllers are required to ensure the security of personal data. They must prevent the data’s alteration and damage, or access by non-authorised third parties. In this regard, Data Controllers should make sure that:

• Persons with access to the system can only access the data that they are allowed to access;
• The identity and interest of any third-party recipients of the data can be verified;
• The identity of persons who have access to the system (to view or add data) can be verified;
• Unauthorised persons cannot access the place and equipment used for the data processing;
• Unauthorised persons cannot read, copy, modify, destroy, or move data;
• All data entered onto the system are authorised;
• The data will not be read, copied, amended, or deleted without authorisation during the transport or communication of the data.
• The data are backed up with security copies;
• The data are renewed and converted to preserve them. 

(Article 60 of the Act)