 2019  Contract number: [ complete ]  H - Transfers  I - Consent  J - Sole controllership  K - Sub-processing  Any transfer of personal data within the EU or to a third country or international organisation  shall  comply fully with Chapter V of Regulation 2018/1725  to ensure that the level of  protection of natural persons guaranteed by Regulation 2018/1725 is not undermined. In respect of transfers to a third country or international organisation, the Contractor shall not  transfer personal data unless 1) there is a  Commission decision  pursuant to Article 45(3) of  Regulation (EU) 2016/679 or Article 36(3) of Directive (EU) 2016/680 that an adequate level  of protection is ensured in the third country or within the international organisation (an  “adequacy decision”) or 2) where no such adequacy decision exists, unless the Contractor or  sub-contractor has provided  appropriate safeguards and ensured that enforceable data  subject rights and effective legal remedies  for data subjects are available. Any transfers may only take place where the personal data are transferred  solely to allow tasks  within the competence of the controller to be carried out . Recipients may  only use the  personal data in order to execute tasks within the scope  of the contract. The Contractor and/or sub-contractor shall  retain records  of all such transfers and  documentation of suitable safeguards if applicable. In relation to non-ECDC-staff, prior to commencing any processing of their personal data, the  Contractor shall ensure that  informed and explicit consent is obtained  from such persons.  Records of consent  obtained shall be maintained by the Contractor. The Contractor shall process the personal data  only on behalf of the ECDC  and  in compliance  with its written instructions and the Clauses . If it cannot provide such compliance, it shall  promptly inform the ECDC of its inability to comply. In this case the ECDC is entitled to  suspend or terminate the Contract. The Contractor shall ensure, monitor and control that in the event of sub-processing, the activity  is carried out by a sub-processor providing at least the same level of protection for the personal  data and the fundamental rights and freedoms of data subject as the Contractor under the  Clauses. The Contractor shall ensure that, in the event of sub-processing, it has  previously informed  the ECDC  of its plans; given  comprehensive information  on the prospective sub-processors  and their future role in the provision of the service; and it has obtained the ECDC’s  prior  written consent (specific or general written authorization) . The Contractor shall promptly  send a copy of any sub-processor agreement  it concludes to the ECDC. Where the Contractor subcontracts its obligations under the Clauses, with the prior approval of  the ECDC  (specific or general written authorization) , it shall do so only by way of a  written  53 