Section 22

An organisation shall protect personal data in its possession or under its control by making reasonable security arrangements to prevent -

(a} unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks; and

(bJ the loss of any storage medium or device on which personal data is stored.