Part 3: Law enforcement processing Chapter 2: Principles Section 40: The sixth data protection principle
The sixth principle (section 40) requires personal data to be processed in a secure manner. The Commissioner’s guidance stipulates that, in practice, this means that the controller must have appropriate security to prevent the personal data they hold being accidentally or deliberately compromised. In particular, the controller will need to:
	design and organise their security to fit the nature of the personal data they hold and the harm that may result from a security breach;
	be clear about who in their organisation is responsible for ensuring information security;
	make sure they have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and
	be ready to respond to any breach of security swiftly and effectively.