(d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the personal data; and (e) to the measures taken for ensuring the secure transfer of the personal data. (2) Where processing of personal data is carried out by a data processor on behalf of the data controller, the data controller shall, for the purpose of protecting the personal data in the terms mentioned at sub-section (1) ensure that the data processorundertakes to adopt applicable technical and organizational security standards governing processing of personal data, as prescribed by the Commission (3) The data processor is independently liable to take steps to ensure compliance with security standards prescribed under sub-section (1). 9. Data Retention requirements.- ​(1) The personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose. (2) It shall be the duty of a data controller to take all reasonable steps to ensure that all personal data is destroyed or permanently deleted if it is no longer required for the purpose for which it was to be processed. 10. Data integrity and access to data.- ​(1) A data controller shall take reasonable steps to ensure that the personal data is accurate, complete, not misleading and kept up-to-date by having regard to the purpose, including any directly related purpose, for which the personal data was collected and further processed. (2) A data subject shall be given access to his personal data held by a data controller and be able to correct that personal data where the personal data is inaccurate, incomplete, misleading or not up-to-date, except where compliance with a request to such access or correction is refused under this Act. 11. Record to be kept by data controller ​(1) A data controller shall keep and maintain a record of any application, notice, request or any other information relating to personal data that has been or is being processed by him. (2) The Commission may determine the manner and form in which the record is to be maintained. 12​. ​Prohibition on transfer of personal data​.- (1) Personal data shall not be transferred to any unauthorized person or system: Provided that if personal data is required to be transferred to any system located beyond territories of Pakistan or system that is not under the direct control of any of the governments in Pakistan, it shall be ensured that the country where the data is being transferred offers personal data protection equivalent to the protection provided under this Act and the data so transferred shall be processed in accordance with this Act and, where applicable, the consent given by the data subject. 13. ​Personal data breach notification​._(1) In the event of a personal data breach, data controller shall without undue delay and where reasonably possible, not beyond 72 hours of 8