(2) The data controller and his/her data processor, as the case
may be, shall appoint data processor(s) who that provide
sufficient guarantees regarding the technical and organizational
security measures employed to protect the personal data
associated with the processing undertaken and ensure strict
adherence to such measures
(3)
(a) The data controller shall enter into a written contract or any
other legal instrument with Any recourse to the data
processor which ensures that the data processor maintains
security measures on personal data. shall be governed by a
contract or any other legal instrument which in legal terms,
associates the data processor to the data controller.
(b) The contract or legal instruments islative act shall establish:
(i) that the data processor acts only under instruction of the
data controller;
(ii) that the data processor is additionally, responsible for
discharging the duties set out in previous paragraph (1)
associated with the data processor’s processing.
Security
breach
notification
25.
(1) The data controller or his/her representative shall must notify
the Authority, without any undue delay, of any security breach
affecting personal data he/she processes on behalf of the data
controller.
(2) The data processor shall must notify the data controller,
without undue delay, of any security breach affecting personal
data he/she processes on behalf of the data controller.
Obligation of 26.
notification to
the Authority
(1)
(a) Prior to any wholly or partly automated operation or set of
operations intended to serve a single purpose or several
related purposes, the controller or his/her representative, if
any, must notify the Authority.
(b) Any modification to the information provided according to
Section 27 must be notified to the Authority.
(2) The provisions of Previous Paragraph (1) shall does not
apply to operations having the sole purpose of keeping a
register that is intended to provide information to the public by
virtue of an act, decree or ordinance and that is open to
consultation either by the general public or by any person
demonstrating a legitimate interest.
Draft Data Protection Bill Version 1.0
35