Contract number: [ complete ]   2019  Annex  V  – Declaration of confidentiality  In accordance with Article(s)  I.15 and II.8 of Framework Contract number  complete (referred to as “the FWC”) signed between the European Centre for Disease Prevention  and Control (“ECDC”) and  (referred to as “the contractor”), the undersigning  personnel undertakes:  -  To treat in strictest confidence and not make use of or divulge to third party any  information or documents which are linked to performance of the FWC. To continue  to be bound by this undertaking after completion of the tasks entrusted to me under  the FWC;  -  Where the FWC requires the processing of personal data, to act only under the  supervision of ECDC, in particular with regard to the purposes of the processing, the  categories of data which may be processed, the recipients of the data, and the means  by which the data subject may exercise his/herrights.  -  The personal data processed under the FWC shall be treated in accordance with the  provisions of Regulation (EU) 2018/1725 of the European Parliament and the  Council of 23 October 2018 on the protection of natural persons with regard to the  processing of personal data by the Union, institutions, bodies, offices and agencies  and on the free movement of such data and repealing Regulation (EC) No 45/2001  and Decision No 1247/2002/EC. Access to personal data shall be limited to the staff  strictly necessary for the performance, management and monitoring of the FWC.  -  To be bound to the contractor’s technical and organisational security measures  adopted having regard to the risks inherent in the processing and to the nature of the  personal data, information and documents (data) concerned and in particular to:  a) Prevent any unauthorised person from having access to computer systems  processing data, and especially:  aa)  unauthorized reading, copying, alteration or removal of storage media;  ab)  unauthorised data input as well as any unauthorised disclosure, alteration  or erasure of stored data;  ac)  unauthorised persons from using data-processing systems by means of data  transmission facilities;  b) Ensure that authorised users of a data-processing system can access only the data  to which their access right refers;  c) Record which personal data have been communicated, when and towhom;  d) Ensure that personal data being processed on behalf of third parties can be  processed only in the manner prescribed by the contracting institution or body;  e) Ensure that, during communication of data and transport of storage media, the data  cannot be read, copied or erased withoutauthorisation;  f) Design its organisational structure in such a way that it meets data protection  requirements.  52 