communicated in advance to the Agency. Data ‘at rest’ and data in transit cannot be routed, transferred, nor accessed by the contractor to/from outside these countries. 

I.24.8  The contractor shall have measures and system tools in place to ensure that the data subjects can exercise their right of access, rectification, blocking and erasure in an easy manner. Taking into account the nature of the processing, they shall assist the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights. 

I.24.9  The contractor shall maintain a record of all categories of personal data processing activities carried out on behalf of the controller. 

I.24.10 Without prejudice to Art. I.17.3, the contractor shall inform the contracting authority without undue delay, and at the very latest within twenty-four (24) hours of detection, of any information security incident affecting personal data (“personal data breach”), indicating which data was or potentially was accessed / modified / copied / made available to non-authorised persons. The contractor remains responsible for such personal data breach and is subject to damage repair and penalties except if the origin is due to a fault of the contracting authority or one or more of its staff. In addition, the contractor is required to implement internally appropriate mechanisms to deal promptly and effectively with personal data breaches and security incidents. 

I.24.11 The contracting authority’s data is protected by the Protocol of Privileges & Immunities applicable to the EU Institutions and Bodies, which means that they are inviolable and shall be exempt from search, requisition, confiscation or expropriation by national law enforcement bodies. In its capacity of controller, the contracting authority must be notified of any request to access the data without undue delay and in any event before the request is granted. 

## I.25 BENCHMARKING 

To decide on renewals of the FWC, the contracting authority may undertake a benchmarking of the levels and the charges of the services provided under this FWC by comparison with similar services provided by outsourcing vendors and/or in-house IT service providers and suppliers. The results of such benchmarking shall be available in identical form to both the contracting authority and the contractor. 

In order to guarantee that a valid comparison is made, the contracting authority will ensure that: 

– the scope of the Services and supplies being provided by the Contractor is taken into consideration; 

– the comparison group consists of at least four enterprises to ensure statistical significance 

– in case no such comparison group exists the relevant industry best practices or markets with similar requirements shall be taken into account; 

– the relevant comparison data must be guaranteed 

The work of the Bench marker should in principle not exceed four (4) months. 

For the first Benchmarking exercise, the comparison group shall be defined in a document entitled “Comparison Group Definition”. The contracting authority reserves the right to 

