2.

Where personal data are processed by automated means, measures shall be taken as appropriate in view of the risks in particular with the aim of: preventing any unauthorised person from gaining access to computer systems processing personal data; preventing any unauthorised reading, copying, alteration or removal of storage media; preventing any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data; preventing unauthorised persons from using data-processing systems by means of data transmission facilities; ensuring that authorised users of a data-processing system can access no personal data other than those to which their access right refers; recording which personal data have been communicated, at what times and to whom; ensuring that it will subsequently be possible to check which personal data have been processed, at what times and by whom; ensuring that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; ensuring that, during communication of personal data and during transport of storage media, the data cannot be read, copied or erased without authorisation; designing the organisational structure within an institution or body in such a way that it will meet the special requirements of data protection.

← 1. · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.