text: The contractor shall notify relevant personal data breaches to the controller without undue 
  delay and at the latest within 48 hours after the contractor becomes aware of the breach. 
  In such cases, the contractor shall provide the controller with at least the following 
  information: 
  
  (a) nature of the personal data breach including where possible, the categories and 
  approximate number of data subjects concerned and the categories and approximate 
  number of personal data records concerned; (b) likely consequences of the breach; (c) 
  measures taken or proposed to be taken to address the breach, including, where 
  appropriate, measures to mitigate its possible adverse effects. 
  
  The contractor shall immediately inform the data controller if, in its opinion, an instruction 
  infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member 
  State data protection provisions as referred to in the tender specifications. 