For the purposes of determining the appropriate technical and organisational measures in relation to personal data that are required to be taken by a controller or processor in order to ensure compliance with this Part, and in particular sections 71(1)(f), 75(1), 76 and 80, the controller or processor, as the case may be, shall, where relevant, have regard to the following matters:
(a) the nature of the personal data concerned;
(b) the accessibility of the data;
(c) the nature, scope, context and purpose of the processing concerned;
(d) any risks to the rights and freedoms of individuals arising from the processing concerned;
(e) the likelihood of any such risks arising and the severity of such risks;
(f) the state of the art and the cost of implementation;
(g) guidelines, recommendations and descriptions of best practice issued by the Commission or the European Data Protection Board.