Appropriate Security Measures. The breach notification requirement should be consid- ered within the context of the existing security obliga- tions that rest upon data controllers. In line with Arti- cle 17 of the EU Privacy Directive, the Dutch Data Pro- tection Act requires that the data controller implements appropriate technical and organisational measures to secure personal data against loss or against any form of unlawful processing. These measures should guarantee an appropriate level of security, taking into account the state of the art and the costs of implementation, and hav- ing regard to the risks associated with the processing and the nature of the personal data to be protected. Each sit- uation must be assessed individually in order to identify the appropriate security measures for the case at hand. As in practice it is not always clear what is to be under- stood under appropriate security, the DPA offers some guidance in its guidelines, which were published in 2013. These guidelines replaced the 2001 guidelines (AV23).13 With the help of the 2013 guidelines, organi- sations should keep verifying whether their security measures are up-to-date.
Appropriate Security Measures. 9.1 The LA agrees to comply with the seventh principle of the Data Protection Act 1998 regarding security and to ensure that adequate security arrangements are in place, in order to protect the integrity and confidentiality of the information held. All personal data will be held electronically and will be password protected.
9.2 Both parties agree not to transfer personal information by unsecure email, only to use secure electronic mechanisms such as B2B, First Class or the S2S secure transfer website.
Appropriate Security Measures. The Recipient shall establish and implement appropriate technical and organizational measures to secure the Dataset and protect it from accidental or unlawful destruction, loss, alteration, unauthorised access and/or disclosure. The Recipient shall provide a level of security appropriate to the risk represented by the use and transfer of the Dataset. The Recipient shall use and store the Dataset only on access-limited, password-protected computers and/or servers protected by current anti-virus, anti-malware and encryption (including on any portable devices). The Recipient represents and warrants that appropriate security measures are in place at the date of signature of the Agreement and will be maintained and applied to the Dataset for as long as they are held by it. The Recipient shall notify the Supplier of any changes that may affect these security modalities.
Appropriate Security Measures a. Reference Incident Response Policy
