text: The contractor shall assist the controller for the fulfilment of its obligations pursuant to 
  Article 33 to 41 under Regulation (EU) 2018/1725 to: 
  
  (a) ensure compliance with its data protection obligations regarding the security of the 
  processing, and the confidentiality of electronic communications and directories of users; 
  (b) notify a personal data breach to the European Data Protection Supervisor; (c) 
  communicate a personal data breach without undue delay to the data subject, where 
  applicable; (d) carry out data protection impact assessments and prior consultations as 
  necessary. 
  
  The contractor shall maintain a record of all data processing operations carried on behalf 
  of the controller, transfers of personal data, security breaches, responses to requests for 
  exercising rights of people whose personal data is processed and requests for access to 
  personal data by third parties. 
  
  The contracting authority is subject to Protocol 7 of the Treaty on the Functioning of the 
  European Union on the privileges and immunities of the European Union, particularly as 
  regards the inviolability of archives (including the physical location of data and services as 
  set out in Article I.9.2) and data security, which includes personal data held on behalf of 
  the contracting authority in the premises of the contractor or subcontractor. 