The contractor may act only on documented written instructions and under the supervision of the  controller, in particular with regard to the purposes of the processing, the categories of data that may  be processed, the recipients of the data and the means by which the data subject may exercise its  rights.  The contractor shall grant personnel access to the data to the extent strictly necessary for the  implementation, management and monitoring of the FWC. The contractor must ensure that personnel  authorised to process personal data has committed itself to confidentiality or is under appropriate  statutory obligation of confidentiality in accordance with the provisions of Article II.8.  The contractor shall adopt appropriate technical and organisational security measures, giving due  regard to the risks inherent in the processing and to the nature, scope, context and purposes of  processing, in order to ensure, in particular, as appropriate:  (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of  processing systems and services; (c) the ability to restore the availability and access to personal data in a timely manner in the  event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and  organisational measures for ensuring the security of the processing; (e) measures to protect personal data from accidental or unlawful destruction, loss, alteration,  unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.  The contractor shall notify relevant personal data breaches to the controller without undue delay and  at the latest within 48 hours after the contractor becomes aware of the breach. In such cases, the  contractor shall provide the controller with at least the following information:  (a) nature of the personal data breach including where possible, the categories and approximate  number of data subjects concerned and the categories and approximate number of personal data  records concerned; (c) measures taken or proposed to be taken to address the breach, including, where appropriate,  measures to mitigate its possible adverse effects.  The contractor shall immediately inform the data controller if, in its opinion, an instruction infringes  Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data  protection provisions as referred to in the tender specifications.  The contractor shall assist the controller for the fulfilment of its obligations pursuant to Article 33 to  41 under Regulation (EU) 2018/1725 to:  (a) ensure compliance with its data protection obligations regarding the security of the  processing, and the confidentiality of electronic communications and directories of users; (c) communicate a personal data breach without undue delay to the data subject, where  applicable; The contractor shall maintain a record of all data processing operations carried on behalf of the  controller, transfers of personal data, security breaches, responses to requests for exercising rights of  people whose personal data is processed and requests for access to personal data by third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the European  Union on the privileges and immunities of the European Union, particularly as regards the inviolability  of archives (including the physical location of data and services as set out in Article I.9.2) and data  23  (d) carry out data protection impact assessments and prior consultations as necessary.  (b) notify a personal data breach to the European Data Protection Supervisor;  (b) likely consequences of the breach; (a) the pseudonymisation and encryption of personal data;