As of now, the PDPB does not have a ready guideline in this respect. However, Article 15(1) of the Personal Data Protection Act provides that "the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing". For example, where a general customer database is stored on stand-alone computers, adequate protection can be set up with password access and operator authorization. Computer systems and servers of large institutions must have software protection and access authorization and other protection technologies, as well as a set of internal operation rules, to prevent unauthorized access by hackers or others and their making use of whatever customer data is available.