2. In particular, any legal act or internal rule referred to in paragraph 1 shall contain specific provisions, where relevant, as to:
|
(a)
|
the purposes of the processing or categories of processing;
|
|
(b)
|
the categories of personal data;
|
|
(c)
|
the scope of the restrictions introduced;
|
|
(d)
|
the safeguards to prevent abuse or unlawful access or transfer;
|
|
(e)
|
the specification of the controller or categories of controllers;
|
|
(f)
|
the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; and
|
|
(g)
|
the risks to the rights and freedoms of data subjects.
|