The General Data Protection Regulation ((EU) 2016/9679) (GDPR)
came into effect on 25 May 2018. One of the key principles centres
on integrity and confidentiality of personal data. Article 5(1)(f)
of the GDPR provides that personal data shall be:
"processed in a
manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing
and against accidental loss, destruction or damage, using
appropriate technical or organisational measures (emphasis
added)"
The GDPR goes a little further than the previous data protection
framework (that is, under the EU Data Protection Directive
95/46/EC) and provides some description of the technical and
organisational measures expected to achieve a level of security
appropriate to the risk associated with the processing of personal
data (see Article 32 of the GDPR). Inevitably, however, decisions
around security will need to be made by the controller and/or
processor – and it
