Contract number: ECHA/2020/666  I.25 BENCHMARKING  18  For the first Benchmarking exercise, the comparison group shall be defined in a document  entitled “Comparison Group Definition”. The contracting authority reserves the right to  The work of the Bench marker should in principle not exceed four (4) months. – the relevant comparison data must be guaranteed – in case no such comparison group exists the relevant industry best practices or markets  with similar requirements shall be taken into account; – the comparison group consists of at least four enterprises to ensure statistical significance – the scope of the Services and supplies being provided by the Contractor is taken into  consideration; In order to guarantee that a valid comparison is made, the contracting authority will ensure  that: To decide on renewals of the FWC, the contracting authority may undertake a  benchmarking of the levels and the charges of the services provided under this FWC by  comparison with similar services provided by outsourcing vendors and/or in-house IT  service providers and suppliers. The results of such benchmarking shall be available in  identical form to both the contracting authority and the contractor. I.24.11 The contracting authority’s data is protected by the Protocol of Privileges &  Immunities applicable to the EU Institutions and Bodies, which means that they are  inviolable and shall be exempt from search, requisition, confiscation or expropriation by  national law enforcement bodies. In its capacity of controller, the contracting authority  must be notified of any request to access the data without undue delay and in any event  before the request is granted.  I.24.10 Without prejudice to Art. I.17.3, the contractor shall inform the contracting  authority without undue delay, and at the very latest within twenty-four (24) hours of  detection, of any information security incident affecting personal data (“personal data  breach”), indicating which data was or potentially was accessed / modified / copied / made  available to non-authorised persons. The contractor remains responsible for such personal  data breach and is subject to damage repair and penalties except if the origin is due to a  fault of the contracting authority or one or more of its staff. In addition, the contractor is  required to implement internally appropriate mechanisms to deal promptly and effectively  with personal data breaches and security incidents.  I.24.9  The contractor shall maintain a record of all categories of personal data processing  activities carried out on behalf of the controller.  I.24.8  The contractor shall have measures and system tools in place to ensure that the  data subjects can exercise their right of access, rectification, blocking and erasure in an  easy manner. Taking into account the nature of the processing, they shall assist the  controller by appropriate technical and organisational measures, insofar as this is possible,  for the fulfilment of the controller’s obligation to respond to requests for exercising the  data subject’s rights.  communicated in advance to the Agency. Data ‘at rest’ and data in transit cannot be routed,  transferred, nor accessed by the contractor to/from outside these countries. 