 2019  Contract number: [ complete ]  N - Security measures O - Data breach notification the processing of data entrusted by the ECDC to the Contractor with the contractual obligations  and with the applicable data protection rules and principles. The Contractor shall duly co-operate in those inspections, free of cost. The Contractor shall ensure that it has  a proper IT Security Risk Management framework  in place  and has implemented the relevant technical and security measures set out under the  relevant framework as well as those measures specified in the Contract and/or in the SLA before  processing the data on behalf of the ECDC and that it will properly maintain the framework and  manage the risks for the duration of the Contract. In assessing the appropriate level of security the Contractor shall take account in particular of  the risks that are presented by the processing, in particular those deriving from accidental or  unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data  transmitted, stored or otherwise processed. The Contractor shall maintain documentation regarding the framework and the security and  technical measures in place and shall provide the ECDC with adequate access to it, to enable it  to comply with the requirements of the Regulation 2018/1725. The Contractor shall implement appropriate mechanisms to deal promptly and effectively with  security incidents and personal data breaches. These shall include reporting mechanisms  ensuring that the  ECDC is notified of any possible personal data breaches  (security incidents  affecting personal data processed on behalf of the EU institution). The Contractor shall notify relevant personal data breaches to the ECDC without undue delay  and in any case no later than 24 hours after the discovery, for the ECDC to be able to notify, if  needed based on the requirements of Regulation 2018/1725, the impacted data subjects without  undue delay and the EDPS within 72 hours after the Contractor becomes aware of the breach. The Contractor shall provide the ECDC with at least the following information: - Nature of the personal data breach including where possible, the categories and approximate  number of data subjects concerned and the categories and approximate number of personal data  records concerned. - Likely consequences of the personal data breach. - Measures taken or proposed to be taken to address the personal data breach, including, where  appropriate, measures to mitigate its possible adverse effects. The Contractor shall collaborate with the ECDC institutions to enable it to comply with all  relevant obligations set out by Regulation 2018/1725 on personal data breaches. 55 