Part 3: Law enforcement processing Chapter 4: Controller and processor Section 66: Obligations relating to security
These sections sets out the security obligations on the controller, and where necessary the processor, in both manual and automated processing. The essence of the requirement is to ensure that data is protected according to the risk. Risks will need to be evaluated and appropriate measures implemented, for example, this might include encryption as this would mitigate the effects of any breach, or specific levels of security clearance for staff processing the data.