accordance with the requirements stated in the Tender Specifications. Personal data relating to Europol staff obtained during the performance of this  Framework Contract  shall be processed only in accordance with the requirements set by the Data controller and in accordance with the applicable data protection legislation. If requested by Europol in writing, the Contractor shall provide additional information and/or evidence with regard to processing of Europol staff Personal data  at the required standards 24 . 

4. (i) When the Special Conditions (or exceptionally the provisions of a particular Purchase Order or Specific Contract placed under this Framework Contract)  foresee the transfer of Personal data  to a third country outside of the EU or of the EEA, the parties acknowledge that this will be done on the basis of: 

(a) an applicable European Commission's adequacy decision, or 

(b) valid European Commission's standard contractual clauses for data protection adopted by implementing decision, if the European Commission has not adopted an adequacy decision for the third country outside the EU, or 

(c) a case-by-case assessment that will ensure respect for Europol’s obligations under its Regulation and under EU data protection legislation, and in relation to which the particular contractual provisions are provided for either in the Special Conditions, the Specific Contract or in the Purchase Order . 

Where the basis for the transfer is (b) or (c), the Parties shall cooperate in good faith to agree any updated wording required in light of best practice or as a result of standard contractual clauses updated by implementing decision of the European Commission for the transfer of Personal data to third countries (excluding EEA countries for this purpose). 

5. The Contractor shall grant its personnel access to Europol Personal data to the extent strictly necessary for the implementation, management and monitoring of the FWC. The Contractor must ensure that personnel authorised to process personal data have committed to confidentiality or are under appropriate statutory obligations of confidentiality in accordance with the provisions of Article II-15 of the FWC. 

6. In relation to any Personal data  which the Contractor  requires to store and use for the performance of its contractual obligations, the agrees to provide sufficient guarantees that appropriate technical and organisational measures are implemented so that processing meets the requirements of the applicable data protection legislation and ensures the protection of the rights of the data subject. In respect of automated data processing, the Contractor shall implement measures designed to protect Personal data  against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing. The Contractor  shall have due regard to the risks inherent to the processing and to the nature of such data, in order to: 

i. deny unauthorised persons access to data-processing equipment used for processing Personal data  (equipment access control); 

ii. prevent the unauthorised reading, copying, modification or removal of data media (data media control); 

