Each depository and its depository agent shall take reasonable measures to protect information and documents related to the affairs of depositors and in particular, related to their securities accounts, against unauthorised access by persons.