3398 GOVERNMENT GAZETTE (e) the name and contact details of the DPO. The Authority shall receive upon request any other information necessary to assess the lawfulness of the processing and, in particular, the existing risks for the protection of personal data of the data subjects and of the related safeguards. 5. Where the Authority is of the opinion that the intended processing would infringe the law, in particular where the controller has insufficiently identified the risk or has not taken sufficient measures to mitigate the risk, the Authority may provide, within a period of up to six (6) weeks of receipt of the request for consultation, written recommendations to the controller and, where applicable, the processor with regard to additional measures to be taken. The Authority may extend that period by one (1) month if the intended processing is highly complex. In this case, the Authority shall inform the controller or processor of any such extension. 6. Where the envisaged processing is necessary for the performance of the tasks of the controller, and is therefore particularly urgent, the controller may initiate such processing after the start of the consultation, but before the expiry of the period referred to in the first subparagraph of the previous paragraph. In this case, the recommendations must be taken into account ex post and the method of processing shall be adjusted accordingly. Article 68 Records of processing activities (Article 24 of the Directive) 1. The controller shall maintain a record of all categories of processing activities under his or her responsibility. That record shall contain the following information: (a) the name or business name and the contact details of the controller and, where applicable, any joint controller and the DPO; (b) the purposes of the processing; (c) the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organisations; (d) a description of the categories of data subjects and of the categories of personal data; (e) where applicable, the use of profiling; (f) where applicable, the categories of transfers of personal data to a third country or an international organisation; (g) an indication of the legal basis for the processing; (h) the prescribed time limits for erasure of the different categories of personal data or for review of the need for their erasure; and (i) a general description of the technical and organisational security measures referred to in Article 62. 2. The processor should maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name or business name and the contact details of each processor, each controller on behalf of whom the processor is acting and, where applicable, of the DPO; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to an A’ 137/29.08.2019 identified third country or an international organisation where the processor has explicitly been instructed to do so by the controller; and (d) where possible, a general description of the technical and organisational security measures referred to in Article 62. 3. The records referred to in paragraphs 1 and 2 shall be in writing. 4. The controller and processor shall make those records available to the Authority on request. Article 69 Data protection by design and by default (Article 20 of the Directive) 1. The controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, take appropriate measures to implement data protection principles, such as data minimisation, in an effective manner, in order to ensure compliance with the legal requirements and the protection of the rights of data subjects. The controller shall take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the protected legitimate interests of the data subject. In particular, personal data shall be processed and the processing systems shall be selected and designed in accordance with the principle of minimisation. As far as possible, personal data shall be anonymised or pseudonymised as soon as possible in accordance with the purpose of the processing. 2. The controller shall implement appropriate technical and organisational measures to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed. This applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible by automated means to an indefinite number of persons. Article 70 Distinction between different categories of data subject (Αrticle 6 of the Directive) 1. Where processing personal data, the controller shall, as far as possible, make a clear distinction between different categories of data subjects. This applies in particular to the following categories: (a) persons with regard to whom there are serious grounds for believing that they have committed a criminal offence; (b) persons with regard to whom there are serious grounds for believing that they are about to commit a criminal offence; (c) persons convicted of a criminal offence; (d) victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; and (e) other persons, such as witnesses, informants or contacts or associates of the persons referred to in indents