Contract number: [ complete ]  Service contract conditions of December 2018  (a) nature of the personal data breach including where possible, the categories and  approximate number of data subjects concerned and the categories and approximate  number of personal data records concerned;  (b) likely consequences of the breach;  (c) measures taken or proposed to be taken to address the breach, including, where  appropriate, measures to mitigate its possible adverse effects.  The contractor shall immediately inform the data controller if, in its opinion, an instruction  infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member  State data protection provisions as referred to in the tender specifications.  The contractor shall assist the controller for the fulfilment of its obligations pursuant to  Article 33 to 41 under Regulation (EU) 2018/1725 to:  The contractor shall maintain a record of all data processing operations carried on behalf of  the controller, transfers of personal data, security breaches, responses to requests for  exercising rights of people whose personal data is processed and requests for access to  personal data by third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the  European Union on the privileges and immunities of the European Union, particularly as  regards the inviolability of archives (including the physical location of data and services as set  out in Article I.9.2) and data security, which includes personal data held on behalf of the  contracting authority in the premises of the contractor or subcontractor.  The contractor shall notify the contracting authority without delay of any legally binding  request for disclosure of the personal data processed on behalf of the contracting authority  made by any national public authority, including an authority from a third country. The  contractor may not give such access without the prior written authorisation of the contracting  authority.  The duration of processing of personal data by the contractor will not exceed the period  referred to in Article II.24.2. Upon expiry of this period, the contractor shall, at the choice of  the controller, return, without any undue delay in a commonly agreed format, all personal data  processed on behalf of the controller and the copies thereof or shall effectively delete all  personal data unless Union or national law requires a longer storage of personal data. For the purpose of Article II.10, if part or all of the processing of personal data is  subcontracted to a third party, the contractor shall pass on the obligations referred to in  Articles I.9.2 and II.9.2 in writing to those parties, including subcontractors. At the request of  the contracting authority, the contractor shall provide a document providing evidence of this  commitment. 21  (a) ensure compliance with its data protection obligations regarding the security of the  processing, and the confidentiality of electronic communications and directories of  users; (b) notify a personal data breach to the European Data Protection Supervisor;  (c) communicate a personal data breach without undue delay to the data subject, where  applicable;  (d) carry out data protection impact assessments and prior consultations as necessary. 