P.U. (A) 335 (b) phone number; (c) fax number, if any; (d) e-mail address, if any; and (e) such other related information. Disclosure Principle List of disclosure 5. The data user shall keep and maintain a list of disclosure to third parties for the purposes of paragraph 8(b) of the Act in relation to personal data of the subject data that has been or is being processed by him. Security Principle Security policy 6. (1) The data user shall develop and implement a security policy for the purposes of section 9 of the Act. (2) The data user shall ensure the security policy referred to in subregulation (1) complies with the security standard set out from time to time by the Commissioner. (3) The data user shall ensure that the security standard in the processing of personal data be complied with by any data processor that carry out the processing of the personal data on behalf of the data user. 15