10 Security in processing Persons who process personal data Section 30 A personal data assistant and a person or those persons who work under the assistant’s or the controller of personal data’s direction may only process personal data in accordance with instructions from the controller of personal data. There shall be a written contract on the processing by the personal data assistant of personal data on behalf of the controller of personal data. It shall be specifically stipulated in the contract that the personal data assistant may only process personal data in accordance with instructions from the controller of personal data and that the personal data assistant is liable to take those measures referred to in Section 31, first paragraph. If there are special provisions in a statute or other enactment concerning processing of personal data in public operations as regards matters referred to in the first paragraph, these shall apply instead of that stated in the first paragraph. Security measures Section 31 The controller of personal data shall implement appropriate technical and organisational measures to protect the personal data that is processed. The measures shall provide a level of security that is appropriate having regard to a) the technical possibilities available, b) what it would cost to implement the measures, c) the special risks that exist with processing of personal data, and d) how sensitive the personal data processed really is. If the controller of personal data engages a personal data assistant, the controller of personal data shall ensure for him/herself that the personal data assistant can implement the security measures that must be taken and ensure that the personal data assistant actually takes the measures. The supervisory authority may decide on security measures Section 32 The supervisory authority may in an individual case decide on which security measures the controller of personal data shall implement in accordance with Section 31. Section 45 contains rules about the powers of the supervisory authority to make the decision subject to a default fine.