Contract number: EEAS-618-DELBRBB-SER-FWC-2019   Template of June 2018 Updated November 2018  The contractor shall adopt appropriate technical and organisational security measures, giving  due regard to the risks inherent in the processing and to the nature, scope, context and  purposes of processing, in order to ensure, in particular, as appropriate: The contractor shall notify relevant personal data breaches to the controller without undue  delay and at the latest within 48 hours after the contractor becomes aware of the breach. In  such cases, the contractor shall provide the controller with at least the following information:  The contractor shall immediately inform the data controller if, in its opinion, an instruction  infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member  State data protection provisions as referred to in the tender specifications.  The contractor shall assist the controller for the fulfilment of its obligations pursuant to  Article 33 to 41 under Regulation (EU) 2018/1725 to:  The contractor shall maintain a record of all data processing operations carried on behalf of  the controller, transfers of personal data, security breaches, responses to requests for  exercising rights of people whose personal data is processed and requests for access to  personal data by third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the  European Union on the privileges and immunities of the European Union, particularly as  regards the inviolability of archives (including the physical location of data and services as set  20  (a) the pseudonymisation and encryption of personal data;  (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of  processing systems and services;  (c) the ability to restore the availability and access to personal data in a timely manner in  the event of a physical or technical incident;  (d) a process for regularly testing, assessing and evaluating the effectiveness of technical  and organisational measures for ensuring the security of the processing;  (e) measures to protect personal data from accidental or unlawful destruction, loss,  alteration, unauthorised disclosure of or access to personal data transmitted, stored or  otherwise processed.  (a) nature of the personal data breach including where possible, the categories and  approximate number of data subjects concerned and the categories and approximate  number of personal data records concerned;  (b) likely consequences of the breach;  (c) measures taken or proposed to be taken to address the breach, including, where  appropriate, measures to mitigate its possible adverse effects.  (a) ensure compliance with its data protection obligations regarding the security of the  processing, and the confidentiality of electronic communications and directories of  users; (b) notify a personal data breach to the European Data Protection Supervisor;  (c) communicate a personal data breach without undue delay to the data subject, where  applicable;  (d) carry out data protection impact assessments and prior consultations as necessary. 