Contract number: ECHA/2019/355  FWC conditions of October 2018 
22 
The contractor shall assist the controller for the fulfilment of its obligations pursuant to 
Article 33 to 41 under Regulation (EU) 2018/1725 to: 
(a) ensure compliance with its data protection obligations regarding the security of the 
processing, and  the confidentiality of electronic communications and directories of users; 
(b) notify a personal data breach to the European Data Protection Supervisor; (c) 
communicate a personal data breach without undue delay to the data subject, where 
applicable; (d) carry out data protection impact assessments and prior consultations as 
necessary. 
The contractor shall maintain a record of all data processing operations carried on behalf 
of the controller, transfers of personal data, security breaches, responses to requests for 
exercising rights of people whose personal data is processed and requests for access to 
personal data by third parties. 
The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the 
European Union on the privileges and immuniti es of the European Union, particularly as 
regards the inviolability of archives (including the physical location of data and services as 
set out in Article I.9.2) and data security, which includes personal data held on behalf of 
the contracting authority in the premises of the contractor or subcontractor. 
The contractor shall notify the contracting authority without delay of any legally binding 
request for disclosure of the personal data processed on behalf of the contracting authority 
made by any national public authority, including an authority from a third country. The 
contractor may not give such access without the prior written authorisation of the 
contracting authority. 
The duration of processing of personal data by the contractor will not exceed the p eriod 
referred to in Article II.24.2. Upon expiry of this period, the contractor shall, at the choice 
of the controller, return, without any undue delay in a commonly agreed format, all 
personal data processed on behalf of the controller and the copies the reof or shall 
effectively delete all personal data unless Union or national law requires a longer storage 
of personal data. 
For the purpose of Article II.10, if part or all of the processing of personal data is 
subcontracted to a third party, the contracto r shall pass on the obligations referred to in 
Articles I.9.2 and II.9.2 in writing to those parties, including subcontractors. At the request 
of the contracting authority, the contractor shall provide a document providing evidence of 
this commitment. 
 
II.10. Subcontracting 
II.10.1 The contractor must not subcontract and have the FWC implemented by third 
parties beyond the third parties already mentioned in its tender without prior 
written authorisation from the contracting authority. 
II.10.2 Even if the contracting authority authorises subcontracting, the contractor remains 
bound by its contractual obligations and is solely responsible  for the 
implementation of the FWC. 
II.10.3 The contractor must ensure that the subcontract does not affect the rights of the 
contracting authority under this FWC, particularly those under Articles II.8, II.13 
and II.24. 
II.10.4 The contracting authority  may request the contractor to replace a subcontractor