Part 4: Intelligence services processing Chapter 4: Controller and processor Section 107: Security of processing
This section sets out the security obligations on the controller, and where necessary the processor, in both manual and automated processing. The essence of the requirement is to ensure that data is protected according to the risk. Risks will need to be evaluated and appropriate measures implemented. These might include:
	record- or log-keeping to ensure access to and processing of the data can be audited;
	an ability to verify the integrity of stored data and restore it if it becomes corrupted;
	specific levels of security clearance for staff processing the data;
	restricting physical access to systems holding personal data;
	network security measures to prevent unauthorized access to electronic systems; or
	restrictions on access to data by staff who do not need to access to that element of the personal data held by the controller.