text: The contractor shall notify the contracting authority without delay of any legally binding 
  request for disclosure of the personal data processed on behalf of the contracting authority 
  made by any national public authority, including an authority from a third country. The 
  contractor may not give such access without the prior written authorisation of the 
  contracting authority. 
  
  The duration of processing of personal data by the contractor will not exceed the period 
  referred to in Article II.24.2. Upon expiry of this period, the contractor shall, at the choice 
  of the controller, return, without any undue delay in a commonly agreed format, all 
  personal data processed on behalf of the controller and the copies thereof or shall 
  effectively delete all personal data unless Union or national law requires a longer storage 
  of personal data. 
  
  For the purpose of Article II.10, if part or all of the processing of personal data is 
  subcontracted to a third party, the contractor shall pass on the obligations referred to in 
  Articles I.9.2 and II.9.2 in writing to those parties, including subcontractors. At the request 
  of the contracting authority, the contractor shall provide a document providing evidence of 
  this commitment. 