Cap. 644 ст. 27Data Protection.         Cap. 586.

(1) Any processing of personal data by the Agency for the purpose of this Act shall fully comply with the provisions of

Regulation (EU) 2016/679 of the European Parliament and of the

Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection

Regulation) and the Data Protection Act, including the regulations made thereunder, and the right to the protection of personal data pertaining to natural persons.

(2) The Agency, whilst taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, shall implement appropriate technical and organisational measures in an effective manner and integrate the necessary safeguards into the processing, in order to protect the rights of the data subjects and to ensure a level of security appropriate to the risk.

(3) For the purposes of ensuring and to be able to demonstrate compliance with all the principles relating to the processing of personal data as held in Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the controller shall implement appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.

(4) The data protection officer designated by the Agency in accordance with Article 37 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) shall be involved and consulted properly and in a timely manner on all issues in relation to the processing of personal data.