Personal Data (Privacy) Ordinance
A Guide For Data Users No. 3
Outline Action Plan For Complying with the Data Protection Principles

ACTION 4 - Ensure Security

Data Protection Principle 4 - security of personal data

• Implement arrangements for ensuring an adequate level of protection for the personal data you collect, hold, process or use against unauthorised access, processing, erasure or other use.
  
  
• While there are no hard and fast rules on what constitutes an adequate level of security in a particular case, the greater the sensitivity of the data and harm that would be caused by unauthorised access, etc., the higher the level of security should be. In deciding whether your security precautions provide an appropriate level of protection, you should have regard to:
  
  
  • the location of the data, for example, whether they are held in an area to which access is restricted;
    
    
  • security measures incorporated into the equipment in which the data are held, such as, the use of computer passwords;
    
    
  • measures for ensuring the integrity, prudence and competence of persons having access to the data; and
    
    
  • measures for ensuring secure transmission.