Data Protection [No. 3 of 2021 113 (3) Despite subsection (2), the Data Protection Commissioner shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment under subsection (1). (4) An impact assessment under subsection (1) shall be in a prescribed manner and form. (5) A data controller shall, where necessary, carry out a review to assess if processing is performed in accordance with the data protection impact assessment where there is a change of the risk represented by processing operations. 47. (1) A data controller or data processor, shall provide guarantees regarding the technical and organisational security measures employed to protect the personal data associated with the processing undertaken and ensure strict adherence to such measures. (2) A data controller or the data processor shall, having regard to the nature, scope and purpose of processing personal data undertaken, the risks associated with such processing, and the likelihood and severity of the harm that may result from such processing, implement appropriate security safeguards including— (a) maintaining integrity of personal data using methods including pseudonymisation and encryption; (b) ensuring ongoing confidentiality, integrity and implementation of measures necessary to protect the integrity of personal data; (c) measures necessary to prevent misuse, unauthorised access to, modification, disclosure or destruction of personal data; and (d) implementation of appropriate data protection policies. (3) A data controller and data processor shall undertake a periodic review of security safeguard in accordance with guidelines issued by the Data Protection Commissioner. (4) Where processing is to be carried out on behalf of a data controller, the data controller shall only use processors providing sufficient guarantees to implement appropriate technical and organisational measures in a manner that ensures that the processing will meet the requirements of this Act and protect the rights of the data subject. Security of processing