Article 22

Security of processing 1. Having regard to the state of the art and the cost of their implementation, the controller shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. Such measures shall be taken in particular to prevent any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration, and to prevent all other unlawful forms of processing. 2. Where personal data are processed by automated means, measures shall be taken as appropriate in view of the risks in particular with the aim of: preventing any unauthorised person from gaining access to computer systems processing personal data; preventing any unauthorised reading, copying, alteration or removal of storage media; preventing any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data; preventing unauthorised persons from using data-processing systems by means of data transmission facilities; ensuring that authorised users of a data-processing system can access no personal data other than those to which their access right refers; recording which personal data have been communicated, at what times and to whom; ensuring that it will subsequently be possible to check which personal data have been processed, at what times and by whom; ensuring that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; ensuring that, during communication of personal data and during transport of storage media, the data cannot be read, copied or erased without authorisation; designing the organisational structure within an institution or body in such a way that it will meet the special requirements of data protection.

← art_21__para · All articles · art_22__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.