APPENDIX [ D ] to [ Contract / Agreement] involves the transmission of data over a network, and against all other unlawful forms of processing,  and that these measures ensure a level of security appropriate to the risks presented by the processing  and the nature of the data to be protected having regard to the state of the art and the cost of their  implementation;  (e) that it will ensure compliance with the security measures;  (f) that, if the transfer involves special categories of data, the data subject has been informed or will be  informed before, or as soon as possible after, the transfer that its data could be transmitted to a third  country not providing adequate protection within the meaning of Directive 95/46/EC;  (g) to forward any notification received from the data importer or any sub-processor pursuant to Clause  5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue  the transfer or to lift the suspension;  (h) to make available to the data subjects upon request a copy of the Clauses, with the exception of  Appendix 2, and a summary description of the security measures, as well as a copy of any contract for  sub-processing services which has to be made in accordance with the Clauses, unless the Clauses or  the contract contain commercial information, in which case it may remove such commercial information;  (i) that, in the event of sub-processing, the processing activity is carried out in accordance with Clause  11 by a subprocessor providing at least the same level of protection for the personal data and the rights  of data subject as the data importer under the Clauses; and (j) that it will ensure compliance with Clause 4(a) to (i).  The data importer agrees and warrants:  (a) to process the personal data only on behalf of the data exporter and in compliance with its  instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to  inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to  suspend the transfer of data and/or terminate the contract;  (b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the  instructions received from the data exporter and its obligations under the contract and that in the event  of a change in this legislation which is likely to have a substantial adverse effect on the warranties and  obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it  is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the  contract;  (c) that it has implemented the technical and organisational security measures specified in Appendix 2  before processing the personal data transferred;  (d) that it will promptly notify the data exporter about:  (i) any legally binding request for disclosure of the personal data by a law enforcement authority  unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality  of a law enforcement investigation;  (ii) any accidental or unauthorised access; and  (iii) any request received directly from the data subjects without responding to that request, unless  it has been otherwise authorised to do so;  (e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of  the personal data subject to the transfer and to abide by the advice of the supervisory authority with  regard to the processing of the data transferred;  Version 1.2: COMMISSION DECISION 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of  personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the  Council, as amended. Clause 5 - Obligations of the data importer 