Anti -Doping Organizations shall apply contractual controls that can include, as appropriate, provisions to ensure Third-Party Agents  only Process  Personal Information  on the docum ented instructions of the Anti-Doping Organization, subject any Third-Party Agent  or its staff handling Personal Information  to a duty of confidentiality, apply appropriate technical security measures and organizational measures to the Personal Information , refrain from engaging other parties to Process  the Personal Information  without prior authorization and appropriate contractual controls being in place, require assistance where Participants or other Persons assert rights under this International Standard or applicable law, delete or return all Personal Information  at the conclusion of the service or upon request, and make information available to the Anti -Doping Organization to demonstrate compliance with such controls.