ANNEX II  to General Terms  and Conditions  The Service Provider shall notify relevant personal data breaches to the controller without undue delay and  at the latest within 48 hours after the Service Provider becomes aware of the breach. In such cases, the Service  Provider shall provide the controller with at least the following information:  The Service Provider shall immediately inform the data controller if, in its opinion, an instruction infringes  Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data protection  provisions as referred to in the Framework Agreement.  The Service Provider shall assist the controller for the fulfilment of its obligations pursuant to Article 33 to 41  under Regulation (EU) 2018/1725 to:  The Service Provider shall maintain a record of all data processing operations carried on behalf of the  controller, transfers of personal data, security breaches, responses to requests for exercising rights of  people whose personal data is processed and requests for access to personal data by third parties.  The Bank is subject to Protocol 7 of the Treaty on the Functioning of the European Union on the privileges  and immunities of the European Union, particularly as regards the inviolability of archives (including the  physical location of data and services as set out in this paragraph B of this Annex) and data security, which  includes personal data held on behalf of the Bank in the premises of the Service Provider or subcontractor.  The Service Provider shall notify the Bank without delay of any legally binding request for disclosure of the  personal data processed on behalf of the Bank made by any national public authority, including an authority  from a third country. The Service Provider may not give such access without the prior written authorisation  of the Bank.  The duration of processing of personal data by the Service Provider will not exceed a period of five (5) years  following the expiry or termination of a Contract. Upon expiry of this period, the Service Provider shall, at  the choice of the controller, return, without any undue delay in a commonly agreed format, all personal data  processed on behalf of the controller and the copies thereof or shall effectively delete all personal data  unless Union or national law requires a longer storage of personal data.  For the purpose of § 5 of these General Terms and Conditions, if part or all of the processing of personal  data is subcontracted to a third party, the Service Provider shall pass on the obligations referred to in this  Annex II and in the Framework Agreement in writing to those parties, including subcontractors. At the  request of the Bank, the Service Provider shall provide a document providing evidence of this commitment.  Version dated 26-03-2021  12  (d)  carry out data protection impact assessments and prior consultations as necessary.  (c)  communicate a personal data breach without undue delay to the data subject, where applicable;  (b)  notify a personal data breach to the European Data Protection Supervisor;  (a)  ensure compliance with its data protection obligations regarding the security of the processing, and  the confidentiality of electronic communications and directories of users;  (c)  measures taken or proposed to be taken to address the breach, including, where appropriate,  measures to mitigate its possible adverse effects.  (b)  likely consequences of the breach;  (a)  nature of the personal data breach including where possible, the categories and approximate number  of data subjects concerned and the categories and approximate number of personal data records  concerned; 