Security obligations
The GDPR establishes the general obligations of data controllers and of those processing personal data on their behalf (processors). These include the obligation to implement appropriate security measures, according to the risk involved in the data processing operations they perform.
The legal notices describe the security measures that are deployed in order to protect the end user's personal data.