- A data protection impact assessment must be done prior to the development of an ICT system.
- Collection of personal data by ICT systems should only be done when absolutely necessary.
- When using an IT support service provider, the company must clearly state its data and security requirements.
- When using ready-made solutions, the law firm must ensure personal data is protected at all times.
- Updates and security patches must be applied to IT systems whenever possible.
- A Web Application Firewall must be in place.
- Vulnerability assessments, code reviews, user acceptance testing and penetration testing must be done.
- Data breaches should be reported to the authorities and the compromised system should be shut down while addressing lapses that resulted in the breach.