## A - Description of the processing supported 

The Contractor shall only process those categories of personal data identified as required by ECDC. The categories include … 

## B - Applicable data protection law 

The processing of the personal data shall be carried out in accordance with the relevant provisions of Regulation (EU) 2018/1725 $^{13}$. In particular, and among others, the Contractor shall provide data subjects with specific rights (under Chapter III, Articles 14-25) and as determined in the Contract, the SLA (if applicable) and its annexes. 

## ANNEX VII- Data protection clauses 

Where applicable, the Contractor shall also comply with Regulation (EU) 2016/679 14 (hereinafter “the General Data Protection Regulation”). Where reference is made to Regulation 2018/1725 throughout these clauses, it is implicit that the equivalent provisions of the General Data Protection Regulation are also intended to apply and shall be complied with. 

Any change in legislation applicable to the Contractor preventing it from fulfilling the instructions received from the ECDC and the obligations provided under the Contract which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, shall promptly be notified by the Contractor to the ECDC as soon as the Contractor is aware of the legislative change, even before its entry into force. In this case the ECDC is entitled to suspend and/or terminate the Contract. 

## C - Location of datacentres 

The Contractor and any sub-contractor shall preferably only process personal data (incl. back- up storage) using datacentres or similar premises, located on the territory of the European Union or European Economic Area. In the event that the datacentres or similar premises are located in a third country, the Centre’s permission shall first be obtained prior to any processing, including storage, in the third country and the requirements laid down in Chapter V of Regulation (EU) 2018/1725 shall be complied with in full. 

The Contractor shall provide the ECDC with comprehensive information on the physical location of the servers used by the Contractor and its sub-processors for the provided services (including for backup, business continuity purposes and transit) as well as locations from where remote operations are performed. Any plans for change of location shall be provided by the Contractor to the ECDC before data are processed in the new location with a pre-notice 

