## H - Transfers 

Any transfer of personal data within the EU or to a third country or international organisation shall comply fully with Chapter V of Regulation 2018/1725 to ensure that the level of protection of natural persons guaranteed by Regulation 2018/1725 is not undermined. 

In respect of transfers to a third country or international organisation, the Contractor shall not transfer personal data unless 1) there is a Commission decision  pursuant to Article 45(3) of Regulation (EU) 2016/679 or Article 36(3) of Directive (EU) 2016/680 that an adequate level of protection is ensured in the third country or within the international organisation (an “adequacy decision”) or 2) where no such adequacy decision exists, unless the Contractor or sub-contractor has provided appropriate safeguards and ensured that enforceable data subject rights and effective legal remedies  for data subjects are available. 

Any transfers may only take place where the personal data are transferred solely to allow tasks within the competence of the controller to be carried out . Recipients may only use the personal data in order to execute tasks within the scope  of the contract. 

The Contractor and/or sub-contractor shall retain records of all such transfers and documentation of suitable safeguards if applicable. 

## I - Consent 

In relation to non-ECDC-staff, prior to commencing any processing of their personal data, the Contractor shall ensure that informed and explicit consent is obtained from such persons. Records of consent  obtained shall be maintained by the Contractor. 

## J - Sole controllership 

The Contractor shall process the personal data only on behalf of the ECDC and in compliance with its written instructions and the Clauses . If it cannot provide such compliance, it shall promptly inform the ECDC of its inability to comply. In this case the ECDC is entitled to suspend or terminate the Contract. 

## K - Sub-processing 

The Contractor shall ensure, monitor and control that in the event of sub-processing, the activity is carried out by a sub-processor providing at least the same level of protection for the personal data and the fundamental rights and freedoms of data subject as the Contractor under the Clauses. 

The Contractor shall ensure that, in the event of sub-processing, it has previously informed the ECDC of its plans; given comprehensive information on the prospective sub-processors and their future role in the provision of the service; and it has obtained the ECDC’s prior written consent (specific or general written authorization) . The Contractor shall promptly send a copy of any sub-processor agreement it concludes to the ECDC. 

Where the Contractor subcontracts its obligations under the Clauses, with the prior approval of the ECDC (specific or general written authorization) , it shall do so only by way of a written 

