Part 4: Intelligence services processing Chapter 4: Controller and processor Sections 102 to 106: General obligations of controllers and processors
These sections provide for obligations on controllers and processors.
	Sections 102 and 103 impose general obligations on controllers to take appropriate technical and organisational measures to ensure that the requirements of Part 4 are complied with. In order to demonstrate compliance with Part 4, controllers should adopt appropriate technical and organisational measures which ensure that risks to the rights and freedoms of data subjects are minimised.
	The intention is to ensure that data protection is central to processing operations, including in the planning of new proposals or projects. Instead of data protection being considered after plans are in place or after processing has begun, this places an obligation on the controller prior to processing to put in place appropriate technical and organisational measures to implement the data protection principles. This will ensure that controllers only process personal data which is necessary for the specific purposes of the processing and that the processing reflects and complies with the data protection principles. The purpose is not to place undue burdens on the controller, however an assessment of available technology, cost, type of data and any risks linked to processing must be considered when applying appropriate technical and organisational measures.
	Section 104 establishes the responsibilities for joint controllers. Where two or more controllers jointly determine the purposes and means of processing they are considered joint controllers. To ensure the protection of the rights of data subjects any arrangements in relation to joint controllers must ensure there is unambiguous apportionment of the responsibilities provided for in Part 4.
	Section 105 provides that controllers may only use data processors to process personal data on their behalf if the processor undertakes to implement appropriate measures to comply with the requirements of this Part, and to provide any information necessary to demonstrate that compliance. Data processors (and any person acting under the authority of a processor or controller) may only process personal data on instruction from the controller or to comply with a legal obligation (section 106).