 2019  Contract number: [ complete ]  agreement with the sub-processor which imposes the same obligations on the sub- processor as are imposed on the Contractor under the Clauses . L - Obligation of the Contractor to cooperate with and inform the ECDC M - Obligation to inform and cooperate with the European Data Protection Supervisor  (EDPS) In the event that the sub-processor fails to fulfil its data protection obligations under such  written agreement, the Contractor shall remain fully liable to the ECDC for the performance of  the sub-processor's obligations.  The data protection aspects of the sub-processing shall be governed by Regulation 2018/1725. The Contractor shall deal promptly and properly with all inquiries from the ECDC relating to  the processing of the personal data by the Contractor. The Contractor shall promptly inform the ECDC about the existence of legislation applicable  to it or any sub-processor preventing it from processing personal data only on instructions from  the ECDC or preventing the conduct of an audit of the Contractor or of any sub-processor. In such case, the ECDC shall be entitled to ask for the suspension of the processing of data by  the Contractor and/or the termination of the Contract. The Contractor shall inform the ECDC about: (i) Future changes concerning the service such as the implementation of additional functions,  in due time. (ii) Future changes in the infrastructure and procedures with a potential impact on the service,  and, in due time, about the results of relevant security audits, under guarantee of confidentiality. (iii) Legally binding requests for disclosure of the personal data by a law enforcement authority  within the terms defined in the Clauses in accordance with the applicable law. (iv) Security incidents (and provide adequate support to appropriately manage the possible data  protection risks posed by such incidents), within the terms defined in the Clauses in accordance  with the applicable law. (v) Without undue delay, any request relating to the exercise of data subject’s rights received  directly from the data subjects. In such cases, the Contractor shall not reply to such a request  unless otherwise instructed by the ECDC, and shall provide the ECDC with the necessary  information and tools to manage data subjects’ personal data in terms of access, deletion,  correction, blocking, etc. The Contractor is aware that the EDPS has the right to conduct a visit, an audit or an inspection  of the Contractor, and of any sub-processor, under the same conditions applicable to an audit  of the ECDC itself under Regulation 2018/1725. The audit shall aim at checking compliance of  54 