General This Precedent is a general information security policy, or data security policy, for Irish companies that identifies, at a high level, their obligations to keep company information secure. It is designed to address an employer’s obligation, as a controller, under Regulation (EU) 2016/679, General Data Protection Regulation (EU GDPR), to process personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures (the sixth EU GDPR data protection principle: integrity and confidentiality). The controller is responsible for, and must be able to demonstrate, compliance with the principles. Organisations must implement appropriate technical and organisational measures to demonstrate that they have considered and integrated data compliance measures into their data processing activities. The security measures used should be 'appropriate to the risk', taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing as well as the likelihood and severity of the risk to individuals if security is breached.