Contract number: ECHA/2019/355  FWC conditions of October 2018 
21 
itself to the data controller. They may also address themselves to the Data Protection 
Officer of the data controller. They have the right to lodge a complaint at any time to the 
European Data Protection Supervisor. 
Details concerning the processing of personal data are available in the data protection 
notice referred to in Article I.9. 
II.9.2 Processing of personal data by the contractor 
The processing of personal data by the contractor shal l meet the requirements of 
Regulation (EU) No 2018/1725 and be processed solely for the purposes set out by the 
controller. 
The contractor shall assist the controller for the fulfilment of the controller’s obligation to 
respond to requests for exercising r ights of person whose personal data is processed in 
relation to this FWC as laid down in Chapter III (Articles 14 -25) of Regulation (EU) No 
2018/1725. The contractor shall inform without delay the controller about such requests.  
The contractor may act only on documented written instructions and under the supervision 
of the controller, in particular with regard to the purposes of the processing, the categories 
of data that may be processed, the recipients of the data and the means by which the data 
subject may exercise its rights. 
The contractor shall grant personnel access to the data to the extent strictly necessary for 
the implementation, management and monitoring of the FWC. The contractor must ensure 
that personnel authorised to process personal data has  committed itself to confidentiality 
or is under appropriate statutory obligation of confidentiality in accordance with the 
provisions of Article II.8. 
The contractor shall adopt appropriate technical and organisational security measures, 
giving due regard to the risks inherent in the processing and to the nature, scope, context 
and purposes of processing, in order to ensure, in particular, as appropriate: 
(a) the pseudonymisation and encryption of personal data; (b) the ability to ensure the 
ongoing confid entiality, integrity, availability and resilience of processing systems and 
services; (c) the ability to restore the availability and access to personal data in a timely 
manner in the event of a physical or technical incident; (d) a process for regularly testing, 
assessing and evaluating the effectiveness of technical and organisational measures for 
ensuring the security of the processing; (e) measures to protect personal data from 
accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to 
personal data transmitted, stored or otherwise processed. 
The contractor shall notify relevant personal data breaches to the controller without undue 
delay and at the latest within 48 hours after the contractor becomes aware of the breach. 
In such cases, the contractor shall provide the controller with at least the following 
information: 
(a) nature of the personal data breach including where possible, the categories and 
approximate number of data subjects concerned and the categories  and approximate 
number of personal data records concerned; (b) likely consequences of the breach; (c) 
measures taken or proposed to be taken to address the breach, including, where 
appropriate, measures to mitigate its possible adverse effects. 
The contractor shall immediately inform the data controller if, in its opinion, an instruction 
infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member 
State data protection provisions as referred to in the tender specifications.