The Agency shall apply the Commission’s security rules regarding the protection of EU classified information.

The Agency may establish, in its internal rules, provisions for the handling of non-classified but sensitive information. Such provisions shall cover, inter alia, the exchange, handling and storage thereof.