II.9.2  Processing of personal data by the contractor  The processing of personal data by the contractor shall meet the requirements of Regulation (EU) No  2018/1725 and be processed solely for the purposes set out by the controller.  The contractor shall assist the controller for the fulfilment of the controller’s obligation to respond to requests  for exercising rights of person whose personal data is processed in relation to this FWC as laid down in  chapter III (Articles 14-25) of Regulation (EU) No 2018/1725. The contractor shall inform without delay the  controller about such requests.  The contractor may act only on documented written instructions and under the supervision of the controller,  in particular with regard to the purposes of the processing, the categories of data that may be processed, the  recipients of the data and the means by which the data subject may exercise its rights.  The contractor shall grant personnel access to the data to the extent strictly necessary for the  implementation, management and monitoring of the FWC. The contractor must ensure that personnel  authorised to process personal data has committed itself to confidentiality or is under appropriate statutory  obligation of confidentiality in accordance with the provisions of Article II.8.  The contractor shall adopt appropriate technical and organisational security measures, giving due regard to  the risks inherent in the processing and to the nature, scope, context and purposes of processing, in order to  ensure, in particular, as appropriate:  The contractor shall notify relevant personal data breaches to the controller without undue delay and at the  latest within 48 hours after the contractor becomes aware of the breach. In such cases, the contractor shall  provide the controller with at least the following information:  The contractor shall immediately inform the data controller if, in its opinion, an instruction infringes  Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data protection  provisions as referred to in the tender specifications.  The contractor shall assist the controller for the fulfilment of its obligations pursuant to Articles 33 to 41 under  Regulation (EU) 2018/1725 to:  22  (a) the pseudonymisation and encryption of personal data;  (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing  systems and services;  (c)  the ability to restore the availability and access to personal data in a timely manner in the event  of a physical or technical incident;  (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and  organisational measures for ensuring the security of the processing;  (e) measures to protect personal data from accidental or unlawful destruction, loss, alteration,  unauthorised disclosure of or access to personal data transmitted, stored or otherwise  processed.  (a) nature of the personal data breach including where possible, the categories and approximate  number of data subjects concerned and the categories and approximate number of personal  data records concerned;  (b) likely consequences of the breach;  (c)  measures taken or proposed to be taken to address the breach, including, where appropriate,  measures to mitigate its possible adverse effects. 