The seventh principle
9Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to—
(a)the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and
(b)the nature of the data to be protected.
10The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to the personal data.
11Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller must in order to comply with the seventh principle—
(a)choose a data processor providing sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out, and
(b)take reasonable steps to ensure compliance with those measures.
12Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller is not to be regarded as complying with the seventh principle unless—
(a)the processing is carried out under a contract—
(i)which is made or evidenced in writing, and
(ii)under which the data processor is to act only on instructions from the data controller, and
(b)the contract requires the data processor to comply with obligations equivalent to those imposed on a data controller by the seventh principle.