CHAPTER V—DATA SECURITY AND DATA IMPACT ASSESSMENTS Article 24: Security, integrity and confidentiality of personal data 1. A data controller shall implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data in its possession or under its control including protections against accidental or unlawful destruction, loss, misuse or alteration, unauthorized disclosure or access. 2. In implementing measures under sub-article 1, the data controller shall take into account: a) the amount and sensitivity of the personal data; b) the nature, degree and likelihood of harm to data subjects that could result from the loss, disclosure or other misuse of the personal data; c) the extent of the processing; d) the period of data retention; and e) the availability and cost of any technologies, tools or other measures to be implemented. 3. Measures implemented under sub-article 1 may include: a) pseudonymization or other methods of de-identification of personal data; b) encryption of personal data; c) processes to ensure security, integrity, confidentiality, availability and resilience of processing systems and services; d) processes to restore availability and access to personal data in a timely manner in the event of a physical or technical incident; e) periodic assessments of risks to processing systems, services and transmission over electronic communications networks; f) regular testing, assessing and evaluation of the effectiveness of the measures implemented against current and evolving risks identified; and g) regular updating of the measures and introduction of new measures to address shortcomings in effectiveness and accommodate evolving risks. Article 25: Data breach notifications 1. When a personal data breach has occurred with respect to personal data and is likely to result in a risk to the rights and freedoms of individuals, the data controller shall notify the Authority of the breach within seventy-two hours after having become aware of it. 19