The contractor shall assist the controller for the fulfilment of its obligations pursuant to Article 33 to  41 under Regulation (EU) 2018/1725 to:  The contractor shall maintain a record of all data processing operations carried on behalf of the  controller, transfers of personal data, security breaches, responses to requests for exercising rights of  people whose personal data is processed and requests for access to personal data by third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the European  Union on the privileges and immunities of the European Union, particularly as regards the inviolability  of archives (including the physical location of data and services) and data security, which includes  personal data held on behalf of the contracting authority in the premises of the contractor or  subcontractor.  The contractor shall notify the contracting authority without delay of any legally binding request for  disclosure of the personal data processed on behalf of the contracting authority made by any national  public authority, including an authority from a third country. The contractor may not give such access  without the prior written authorisation of the contracting authority.  The duration of processing of personal data by the contractor will not exceed the period referred to in  Article 9.10 of these general conditions. Upon expiry of this period, the contractor shall, at the choice  of the controller, return, without any undue delay in a commonly agreed format, all personal data  processed on behalf of the controller and the copies thereof or shall effectively delete all personal data  unless Union or national law requires a longer storage of personal data. For the purpose of Article 6 of these general conditions, if part or all of the processing of personal data  is subcontracted to a third party, the contractor shall pass on the obligations referred to in the present  article in writing to those parties, including subcontractors. At the request of the contracting authority,  the contractor shall provide a document providing evidence of this commitment.  Electronically signed on 31/08/2020 21:13 (UTC+02) in accordance with article 4.2 (Validity of electronic documents) of Commission Decision 2004/563 August 2020 c4e_annexigc_en  Page 36 of 36  (a) ensure compliance with its data protection obligations regarding the security of the processing,  and the confidentiality of electronic communications and directories of users; (b) notify a personal data breach to the European Data Protection Supervisor;  (c) communicate a personal data breach without undue delay to the data subject, where  applicable;  (d) carry out data protection impact assessments and prior consultations as necessary. 