NIST Privacy Framework, Protect-PPR.DS-P5

Implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.

Implement technical and organisational measures adequate to the risk to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and choose a processor offering sufficient security guarantees under a written contract that binds them to your instructions.

If enacted as drafted, a data controller or processor would have to implement personal data protection by design and by default, and would have to secure personal data with technical and organizational measures against unauthorized access, collection, use, disclosure, copying, modification, or destruction, and against the loss of any storage medium on which it is held.

Take precautions appropriate to the data's nature and the risks involved to keep personal data secure, including protection against accidental or unlawful destruction, loss, alteration, or unauthorized access.

Inform the data subject about the processing of their personal data, and process it confidentially and with security measures against unauthorized access.

Keep proof of the data subject's authorization, tell them at authorization the purpose of the processing, keep their personal data updated and accurate, secure it against unauthorized alteration, loss, consultation, use or access, and correct it once it is shown to be incorrect.

As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.

Adopt technological, human, administrative, physical and contractual security measures to prevent unauthorized access to, manipulation, destruction, or unauthorized use or circulation of personal data processed in an artificial intelligence system, and keep those measures auditable by the authorities.

Take precautions appropriate to the nature of the data and the risks the processing presents to preserve its security, including against distortion, damage, or access by unauthorized third parties.

Adopt technical and organizational security measures to prevent the alteration, loss, or unauthorized access of personal data.

Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.

Build data protection into the design and the default settings of your processing, restrict processing to persons acting under your authority and on your instructions, and take the measures necessary to secure personal data against loss, alteration, or unauthorized access, having regard to its nature and the risks the processing presents.

Adopt the technical, organizational, and security measures necessary to prevent the alteration, loss, or unauthorized access of personal data, and maintain adequate information policies with security and control measures for every archive, registry, or databank you keep.

Keep personal data confidential under a duty of professional secrecy that continues after your relationship with the data subject or the data controller ends, unless a court relieves you of it for reasons of public security, national defense, or public health.

Secure personal data with the technical and organisational measures articles 37 to 41 require, determined from a risk, threat and vulnerability analysis, and build data protection into the design of your processing and make it the default.

Adopt technical and regulatory procedures and the necessary standard criteria to protect Personal Data and keep it confidential, preventing any hack, damage, alteration or manipulation.

Maintain the technological, regulatory and procedural security measures the Entidad Rectora sets to keep personal data confidential, available and unaltered.

Keep personal data secure, confidential, and limited to what is adequate and not excessive for the stated purpose.

Take appropriate, reasonable technical and administrative measures to secure the integrity of personal information in your possession or under your control against loss, modification, damage, unauthorised destruction or unlawful access, and govern any data processor who processes information on your behalf by a written contract that requires the same measures.

Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage, including pseudonymization and encryption, the ability to restore access to personal data after a physical or technical incident, and a process for regularly testing their effectiveness.

Implement technical and organizational security measures adapted to the risk, including pseudonymization and encryption, and regularly test, assess and evaluate their effectiveness.

Take appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, unauthorised destruction, and unlawful access, and require a data processor acting on your behalf to maintain the same measures under a written contract.

Take practical steps to secure personal data against loss, misuse, unauthorised access, alteration or destruction, and obtain a data processor's own security guarantees before letting it process personal data on your behalf.

Take appropriate technical and organisational measures, including pseudonymisation and encryption, against unauthorised or unlawful processing of personal data and against its accidental loss, destruction or damage.

On commencement, implement appropriate technical and organisational measures against accidental or unlawful destruction, loss, misuse or alteration and unauthorised disclosure or access, taking into account the amount of personal data, the likelihood of harm, the extent of processing, the retention period, and the availability and cost of measures.

Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.

Take all measures, in light of the nature of the data and the risks of processing it, to keep the data intact and secure and to protect it against distortion, damage and access by unauthorized persons.

Take appropriate, reasonable technical measures to secure the integrity of personal information in your possession or under your control against loss, damage, unauthorised destruction or unlawful access, and govern any agent who processes information on your behalf by a written contract that requires the same measures.

Protect customer information and customer communications with security safeguards appropriate to their sensitivity.

Take security precautions appropriate to the data and the risk, to prevent unauthorized access, alteration, loss, or disclosure.

Implement technical and organizational security measures appropriate to the risk, including where you transmit personal data over a network, to protect it against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.

If enacted as drafted, a Controller or Processor would have to secure personal data with appropriate technical, physical or organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage.

Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage, and use a processor only where it offers sufficient security and confidentiality guarantees, which does not relieve you of your own duty to see those guarantees are met.

Store or process personal data with technical and organizational security measures that protect against unauthorized or unlawful processing and against unintentional loss, destruction, or damage, and limit access to staff who need it for their duties.

Establish and maintain administrative, technical, and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing, at a level no lower than the measures you keep for your own information.

Implement technical and organisational measures giving a level of security appropriate to the risk.

Take appropriate technical and organisational security measures, including pseudonymisation and encryption, proportionate to the risk of destruction, loss, alteration, or unauthorised disclosure of or access to the personal data you process.

Implement technical, personnel and organizational safeguards appropriate to the nature of the data processed to protect it against loss, destruction, unauthorized access, alteration, publicizing and abuse, under Article 24, and keep confidential any personal data your staff become privy to in the course of their work, under Article 25.

Implement technical and organizational measures appropriate to the risk and the state of the art, protecting personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, and unauthorized access, including where the processing involves network transmission.

Protect personal data against risk, loss, unauthorised access, destruction, unauthorised use, modification, or disclosure.

Take reasonable steps to maintain the confidentiality of a subscriber's communications, and do not intercept, monitor, alter, or modify their content except as permitted or required by law.

Process personal data only to the extent adequate, proportional, and necessary for the stated purpose, and adopt technical and organizational security measures against unauthorized access, use, alteration, loss, disclosure, transfer, or dissemination.

Keep personal data confidential under a duty of professional secrecy that survives the end of your relationship with the data controller, releasable only by judicial order for reasons of national security, national defense, public security, or public health.

Keep personal data confidential and implement technical and organizational measures against unauthorized access, loss or damage, including pseudonymization, encryption, and data protection by design and by default.

Keep confidential any personal data you access that did not come from a source open to the public, even after your relationship to the processing ends.

Hand over stored personal data to a competent judicial authority only on a properly substantiated request, never in response to a bulk request, and, if you operate a public communications network, maintain the security measures this Law requires to protect it.

Take the security measures article 16 requires of a controller and of a processor.

Adopt technical, organizational, and legal measures that guarantee the security of personal data and prevent its alteration, loss, unauthorized processing, or access, and do not process personal data in a data bank that does not meet the Authority's security requirements.

Keep processing confidential and take precautions appropriate to the data and the risk to preserve its security, including against unauthorised access, alteration or loss.

Implement appropriate technical measures against loss, damage or destruction of personal data, verify regularly that they work, and keep them updated against new or identified risks.

Take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data, its storage, and the personnel with access to it, and require a data processor you engage to give sufficient security guarantees and comply with them.

Take security measures appropriate to the risk of unauthorized access, alteration, or loss of personal data, taking the state of technology and the cost of the measures into account, and make sure staff know and follow them.

Implement technical and organisational measures giving a level of security appropriate to the risk, and cooperate with the Data Protection Authority in the performance of its tasks.

Implement appropriate technical and organizational measures against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access to personal data, choose a subcontractor offering sufficient guarantees, bind it by contract to your instructions and the same measures, and record that contract in a document with legally recognized probative value.

Implement appropriate technical and organisational measures to secure personal data, taking into account the amount and sensitivity of the data and the harm its loss or misuse would cause.

Secure the integrity and confidentiality of personal information in your possession with appropriate technical and organisational measures, identify the foreseeable risks to it, and keep those measures updated as risks change.

Take appropriate technical and organizational security measures against accidental or unauthorized access, destruction, loss, use, alteration, or disclosure of personal data, matched to the risk.

Take the technical and organizational security measures the Authority approves to protect personal data against unauthorized or unlawful processing and against loss or damage, and appoint a data protection officer, registered with the Authority, if you are a legal person.

Take appropriate technical and organizational measures to prevent unauthorized access to, alteration of, or loss of personal data, and keep the data usable regardless of changes in the storage technology used.

Implement appropriate and reasonable technical and organisational measures to prevent accidental, unauthorised or unlawful loss, misuse, destruction of or damage to personal information, and unlawful or unauthorised access to or processing of it.

Keep personal information accurate, complete and up to date as necessary for the purpose of collection, and protect it with safeguards appropriate to its sensitivity.

Identify foreseeable risks to personal data in your possession, establish and maintain safeguards against them, verify regularly that the safeguards work, and update them as risks or deficiencies change.

As an operator or other person processing personal data on a controller's behalf, treat the data as confidential and do not disclose it unless required by law or in the course of discharging your duty.

Adopt the security and confidentiality measures needed to prevent unauthorized alteration, loss, consultation, or processing of personal data, and store it so the data subject can exercise their right of access.

Establish reasonable administrative, technical, and physical security practices for personal data, and enter into a written contract with any processor before it processes personal data on your behalf.

Process personal data with reasonable and appropriate security measures against unauthorised or unlawful processing and against accidental or unauthorised access, destruction, loss, use, modification or disclosure.

Where this Regulation binds your processing, identify the Data Controller as the Governorate, represented by the General Secretary, and put in place organizational and technical security measures suitable to protect the personal data you process. Appoint a Representative in writing where the Regulation calls for one, and record the activity in the Register of treatment activities.

Implement security safeguards proportionate to the risk, including pseudonymisation and encryption, measures against misuse, unauthorised access, modification, disclosure or destruction, and data protection policies, and review them periodically against the Commissioner's guidelines.

Take the security measures section 18 requires, keep your processing open as section 23 requires, and be accountable for it as section 24 requires.

Only process a data subject's biometric information or record of criminal behaviour where you are a body charged with applying criminal law or you obtained the information lawfully, and put appropriate safeguards in place before relying on any special personal information exception.

Follow the information security plans, policies and procedures the Authority sets for protecting sensitive personal data, through your data protection officer and the staff under their supervision.