The organization must implement appropriate technical and organizational measures to protect collected personal information from unauthorized access, disclosure, alteration, damage, or loss.

In the event that personal information is or may be compromised, the organization must:

• Take immediate remedial action to contain and mitigate the incident if personal information is or may be compromised.
• Promptly notify affected individuals in accordance with applicable legal and regulatory requirements.
• Report the incident to the relevant competent authorities without undue delay.
• Document the breach, including its cause, impact, and corrective measures implemented to prevent recurrence.