(74) It is appropriate to impose obligations on the controller and to establish the legal responsibility of the controller for the processing of personal data by him or on his behalf. In particular, the controller should be obliged to implement appropriate and effective measures and should be able to demonstrate that the processing activities comply with this Regulation and that they are effective, taking into account the nature, scope, context and purposes of the processing and the risk of infringement of the rights and freedoms of natural persons.