Europol Public Information  v. carry out data protection impact assessments and prior consultations as necessary.  9. The  Contractor shall maintain a record of all data processing operations carried on behalf of the  Data controller , transfers of  Personal data ,  Personal data breaches , responses to requests for  exercising rights of people whose  is processed and requests for access to  Personal  data  by third parties.  10. The  Contractor  may only act upon documented written instructions and under the supervision of  the  Data controller , in particular with regard to the purposes of the processing, the categories of  Personal data  that may be processed, the recipients of the  Personal data  and the means by which  the data subject may exercise its rights.  11. Without prejudice to paragraph 15 below, the Contractor is not entitled to provide  Personal data  to  other third parties for whatever purpose without Europol’s prior express written consent. Third  parties must also be subject to the conditions set up by Europol.  12. If  Personal data of Europol staff is no longer necessary for the performance of the  Framework  Contract , it shall be deleted or destroyed in accordance with Europol’s written instructions and such  deletion or destruction shall be certified in writing to Europol.  13. The  Contractor  shall notify relevant  Personal data breaches  to the  Data controller  without undue  delay and at the latest within 48 hours after the  Contractor  becomes aware of it. This obligation of  notification is different to the obligation to notify  Personal data breaches  under national law. The  Contractor must notify Europol irrespective of whether the national data protection supervisory  authority is notified or not. In such cases, the  Contractor  shall provide the  Data controller  with at  least the following information:  i. nature of the  Personal data breach  including where possible, the categories and approximate  number of data subjects concerned and the categories and approximate number of  Personal  Data  records concerned;  ii. likely consequences of the breach;  iii. measures taken or proposed to be taken to address the breach, including, where appropriate,  measures to mitigate its possible adverse effects.  14. The  Contractor  shall immediately inform the Data controller if, in its opinion, an instruction infringes  Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data  protection legal provisions as referred to in the tender specifications.  15. The  Contractor shall notify Europol without delay of any legally binding request for disclosure of  Personal data processed on its behalf made by any national public authority, including an authority  from a third country. The  Contractor may not give such access without the prior written  authorisation of Europol unless such prior authorisation would place the Contractor in breach of  national law.  16. Europol or an outside body of its choice shall have the right to verify the data protection compliance  of the Contractor under the Europol Regulation and Regulation (EU) No 2018/1725.  17. Europol is subject to Protocol 7 of the Treaty on the Functioning of the European Union on the  privileges and immunities of the European Union, particularly as regards the inviolability of archives  (including the physical location of data and services as set out in this Article) and data security,  which includes  Personal data held on behalf of Europol in the premises of the Contractor or  subcontractor.  Page 50 of 79  Europol’s initials:  Contractor’s initials:  The obligations in relation to  Personal data  subsist for an unlimited period after the end of this  Framework Contract . 