Contract no: [complete]  The contractor shall notify relevant personal data breaches to the controller without undue delay and at  the latest within 48 hours after the contractor becomes aware of the breach. In such cases, the contractor  shall provide the controller with at least the following information:  The contractor shall immediately inform the data controller if, in its opinion, an instruction infringes  Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data protection  provisions as referred to in the tender specifications.  The contractor shall assist the controller for the fulfilment of its obligations pursuant to Article 33 to 41  under Regulation (EU) 2018/1725 to:  The contractor shall maintain a record of all data processing operations carried on behalf of the  controller, transfers of personal data, security breaches, responses to requests for exercising rights of  people whose personal data is processed and requests for access to personal data by third parties.  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the European Union  on the privileges and immunities of the European Union, particularly as regards the inviolability of  archives (including the physical location of data and services as set out in Article I.9.2) and data security,  which includes personal data held on behalf of the contracting authority in the premises of the contractor  or subcontractor.  The contractor shall notify the contracting authority without delay of any legally binding request for  disclosure of the personal data processed on behalf of the contracting authority made by any national  public authority, including an authority from a third country. The contractor may not give such access  without the prior written authorisation of the contracting authority.  The duration of processing of personal data by the contractor will not exceed the period referred to in  Article II.24.2. Upon expiry of this period, the contractor shall, at the choice of the controller, return,  without any undue delay in a commonly agreed format, all personal data processed on behalf of the  controller and the copies thereof or shall effectively delete all personal data unless Union or national law  requires a longer storage of personal data. For the purpose of Article II.10, if part or all of the processing of personal data is subcontracted to a third  party, the contractor shall pass on the obligations referred to in Articles I.9.2 and II.9.2 in writing to those  parties, including subcontractors. At the request of the contracting authority, the contractor shall provide  a document providing evidence of this commitment.  20 EC - FWC services Dec 2018  d) a process for regularly testing, assessing and evaluating the effectiveness of technical and  organisational measures for ensuring the security of the processing;  e) measures to protect personal data from accidental or unlawful destruction, loss, alteration,  unauthorised disclosure of or access to personal data transmitted, stored or otherwise  processed.  a) nature of the personal data breach including where possible, the categories and approximate  number of data subjects concerned and the categories and approximate number of personal  data records concerned;  b) likely consequences of the breach;  c) measures taken or proposed to be taken to address the breach, including, where appropriate,  measures to mitigate its possible adverse effects.  a) ensure compliance with its data protection obligations regarding the security of the processing,  and the confidentiality of electronic communications and directories of users; b) notify a personal data breach to the European Data Protection Supervisor;  c)  communicate a personal data breach without undue delay to the data subject, where applicable;  d) carry out data protection impact assessments and prior consultations as necessary. 