265 struction in an intelligible form, Security rneasures on integrity of personal inforrnation 20. (1) A data controller shall secure the integrity of personal information in its possession or under its control by taking appropriate, leasonable technical and autholised measures to ptevent(a) loss of, damage to or unauthorisecl destruction of per_ sonal information; and (b) (2) unlawful access to or pr.ocessing of pelsonal informa_ tion. In order to give effect to subsection (1), the data controller shall take reasonable measures to - (a) identify all reasonably foreseeable intemal and externai risks to personal information in its possession or under its control; (b) establish and maintain appropriate safeguards against the risks identified; (c) (d) regula.ly verify that the safeguards a'e effectively implemented; and ensure that the safeguards are continualry updated in response to new risks or deficiencies in previously imple_ mented safeguards. (3) The data controller sha[ have due r.egar.d to generally accepted information security practices and plocedures or professionil rules and regulations which may apply generally or be lequired in the specific industry. rnformation processed by an agent of flre data contnoller 27. An agent or anyone processing personal information on behalf of a data controilel shal1-