S14 (b) if there is no law or code of conduct prescribing a retention period, retain the record for a period which will afford the data subject a reasonable opportunity, taking all considerations relating to the use of the personal information into account, to request access to the record. (4) A data controller shall destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the data controller is no longer authorised to retain the record in terms of subsection (1) or (2). (5) The destruction or deletion of a record of personal information in terms of subsection (4) shall be done in a manner that prevents its reconstruction. Security measures on integrity of personal information 14. (1) A data controller shall secure the integrity of personal information in its possession or under its control by taking appropriate, reasonable technical and administrative measures to prevent – (a) loss of, modification and damage to or unauthorised destruction of personal information; and (b) unlawful access to or processing of personal information. (2) In order to give effect to subsection (1), the data controller shall take reasonable measures to – (a) identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control; (b) establish and maintain appropriate safeguards against the risks identified; (c) regularly verify that the safeguards are effectively implemented; and (d) ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards. (3) The data controller shall have due regard to generally accepted information security practices and procedures or professional rules and regulations which may apply generally or be required in the specific industry. Processing of information by a data processor on behalf of data controller 15. A data processor or anyone processing personal information on behalf of a data controller shall – (a) process such information only with the knowledge or authorisation of the data controller; and (b) treat personal information which comes to their knowledge as confidential and shall not disclose it, unless required by law or in the course of the performance of their duties.