Ensuring the security of the data

The party obligated under section 175(1) must ensure that the data stored under the storage obligation of section 176(1) are protected, by technical and organisational measures in accordance with the state of the art, against unauthorised access and use. The measures comprise, in particular, 1. the use of a particularly secure encryption procedure, 2. storage in separate storage facilities, kept apart from those used for the usual operational functions, 3. storage, with a high level of protection against access from the internet, on data-processing systems decoupled from the internet, 4. restriction of access to the data-processing installations to persons specifically authorised by the obligated party, and 5. the necessary participation of at least two persons, specifically authorised for this by the obligated party, in accessing the data.