than necessary for the purpose for which the data were collected and further  processed (storage limitation).  • Territoriality of datacentres : the personal data related to the EFSA contract may  only be stored in systems or subsystems (including back-up storage) using  datacentres or similar premises, located on the territory of the European Economic  Area (EEA = EU countries + Iceland, Liechtenstein, Norway) + Switzerland. The  Contractor must inform EFSA by means of a list of all locations where EFSA data  will be stored and processed as well as the interconnections. Every additional data  storage and/or treatment location within the EEA envisaged during the period of  implementation of the contract, must be communicated in advance to EFSA. • Data transfers outside EEA:  without prejudice to the territoriality requirement,  any transfer of personal data under the contract to third countries shall fully comply  with the requirements laid down in Chapter V, articles 46-51 of Regulation (EU)  2018/1725.  • Audits:  EFSA shall be allowed to carry out audits or to request that such audits are  carried out by a third party to ascertain that the system and all subsystems have  the necessary technical and organisational measures in place and fulfil the control  and security standards regarding vulnerability and penetration testing. EFSA has  the right to verify or request verification by a third party, at any moment, the  storage, location and access rights of its data and the technical environment on  which its data is treated. • Personal data breaches:  the Contractor has an obligation to inform EFSA, within  48 hours of detection, of any information security incident affecting personal data  under the contract (“personal data breach”), indicating which EFSA data was or  potentially was accessed/modified/copied/made available to non-authorised  persons. The Contractor remains responsible for such personal data breach and is  subject to damage repair and penalties except if the origin is due to a fault of EFSA  and one or more of its staff. In addition, the Contractor is required to implement  appropriate mechanisms to deal promptly and effectively with personal data  breaches and security incidents.  11 