On 1, use the Privacy Notice tool. On 2, GDPR does not define what adequate technical and security measures mean, or how you meet them - you do.