In determining measures to process personal data to ensure security, which factors can be taken into account?

• A. (ii) only.
• B. (iii) only.
• C. (ii) and (iii) only.
• D. (i), (ii) and (iii).

Answer: (D)

Security measures for processing personal data should be chosen using a risk-based, proportional approach. All the factors described should be taken into account because each one informs how strong and how feasible the safeguards need to be. When you consider the nature and sensitivity of the data, the potential harm to individuals if something goes wrong, and the context in which the data is processed (including practical costs and technical feasibility), you arrive at safeguards that are appropriately matched to risk. Relying on only one or two factors can lead to overkill in low-risk situations or inadequate protection in higher-risk scenarios. By weighing all three factors together, the measures are more likely to be effective, reasonable, and sustainable.