; and (C) include a reasonable representation by the service provider indicating that the service provider has established appropriate procedures and controls to comply with the requirements of this Act. (2) Limitation No contract governing the disclosure of personal data by a covered entity to a service provider shall relieve a covered entity or service provider of any requirement or obligation with respect to such personal data that is imposed on the covered entity or service provider, as applicable, by this Act. (c) Service provider obligations (1) Notice of processing of personal data to comply with legal requirement In the event that a service provider is required to process personal data in order to comply with a legal requirement, including a subpoena, summons, or other properly executed compulsory process, the service provider shall inform the covered entity from which it received the personal data involved of such legal requirement before such processing, unless the service provider is otherwise prohibited by law from providing such notification. (2) Notice of change to policies or practices If a service provider amends its policies or practices relating to personal data in a manner that is relevant to compliance with any provision of this Act, the service provider shall provide reasonable notice in advance of such change to any covered entity on whose behalf the service provider collects or processes personal data. (3) Responsibilities (A) Individual control requests A service provider that collects or processes personal data on behalf of a covered entity shall, to the extent possible, either— (i) provide the covered entity with appropriate technical and organizational measures to enable the covered entity to comply with requests to exercise rights described in section 5 with respect to any such personal data that is held by, and reasonably accessible to, the service provider