Both personal and non-personal data should be held securely by the University. In particular Under the Data Protection Act with regard to personal data, the University must ensure, “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.“