; (ii) the requirements under this Act; (iii) the size and complexity of the applicable entity; and (iv) the sensitivity and volume of the personal data that the applicable entity processes; and (B) address the findings and implement the recommendations contained in privacy impact assessments that the applicable entity carries out under subsection (c). 8. Rules relating to service providers (a) Obligations of covered entities with respect to service providers (1) In general A covered entity shall only disclose personal data to a service provider pursuant to a contract that is binding on both parties and meets the requirements of subsection (b). (2) Due diligence (A) In general Any covered entity that discloses personal data to a service provider shall— (i) take reasonable steps to identify whether the service provider has established appropriate procedures and controls for ensuring the privacy and security of the personal data in a manner that complies with the requirements of this Act, including through reasonable representations made to the covered entity by the service provider in the contract governing the disclosure of personal data to the service provider; and (ii) investigate any circumstances for which a reasonable person would determine that there is a high probability that the service provider is not in compliance with a requirement of this Act, and, if necessary based on the findings of such investigation, take reasonable steps to protect the privacy and security of any personal data disclosed by the covered entity to the service provider that is at risk as a result of the service provider's noncompliance with a requirement of this Act. (B) Considerations In determining whether a covered entity has acted reasonably in complying with clause (i) or (ii) of subparagraph (A), the Commission shall take into account— (i) the size, complexity, and resources of the covered entity and whether the covered entity is a small business