2.
In particular, any legal act or internal rule referred to in paragraph 1 shall contain specific provisions, where relevant, as to: the purposes of the processing or categories of processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the specification of the controller or categories of controllers; the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; and the risks to the rights and freedoms of data subjects.
← art_25__para_1__point_i__text_1 · All articles · art_25__para_2__text_1 →
Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.