exceeding 5 years. 30. Personal data of child (1) No person shall process the personal data of a child below the age of 16 years unless consent is given by the child’s parent or guardian. (2) Where the personal data of a child below the age of 16 years is involved, a controller shall make every reasonable effort to verify that consent has been given or authorised, taking into account available technology. 31. Security of processing (1) A controller or processor shall, at the time of the determination of the means for processing and at the time of the processing – (a) implement appropriate security and organisational measures for – (i) the prevention of unauthorised access to;