1. The Agency shall ensure the confidentiality, integrity and protection of the information received pursuant to Article 4(2) and Articles 8 and 10. The Agency shall take all necessary measures to prevent any misuse of, and unauthorised access to, the information maintained in its systems.

The Commission, national regulatory authorities, competent financial authorities of the Member States, national tax authorities, Eurofisc, national competition authorities, ESMA and other relevant authorities shall ensure the confidentiality, integrity and protection of the information that they receive pursuant to Article 4(2), Article 7(2), Article 8(5) or Article 10, shall take steps to prevent any misuse of such information, and shall ensure compliance with the applicable data protection law.

The Agency shall identify sources of operational risk and minimise them through the development of appropriate systems, controls and procedures.