content_image/468094.jpg content_image/468095.jpg
<img src='content_image/468094.jpg'>

<img src='content_image/468095.jpg'>

than necessary for the purpose for which the data were collected and further processed (storage limitation). 

• Territoriality of datacentres : the personal data related to the EFSA contract may only be stored in systems or subsystems (including back-up storage) using datacentres or similar premises, located on the territory of the European Economic Area (EEA = EU countries + Iceland, Liechtenstein, Norway) + Switzerland. The Contractor must inform EFSA by means of a list of all locations where EFSA data will be stored and processed as well as the interconnections. Every additional data storage and/or treatment location within the EEA envisaged during the period of implementation of the contract, must be communicated in advance to EFSA. 

• Data transfers outside EEA: without prejudice to the territoriality requirement, any transfer of personal data under the contract to third countries shall fully comply with the requirements laid down in Chapter V, articles 46-51 of Regulation (EU) 2018/1725. 

• Audits: EFSA shall be allowed to carry out audits or to request that such audits are carried out by a third party to ascertain that the system and all subsystems have the necessary technical and organisational measures in place and fulfil the control and security standards regarding vulnerability and penetration testing. EFSA has the right to verify or request verification by a third party, at any moment, the storage, location and access rights of its data and the technical environment on which its data is treated. 

• Personal data breaches: the Contractor has an obligation to inform EFSA, within 48 hours of detection, of any information security incident affecting personal data under the contract (“personal data breach”), indicating which EFSA data was or potentially was accessed/modified/copied/made available to non-authorised persons. The Contractor remains responsible for such personal data breach and is subject to damage repair and penalties except if the origin is due to a fault of EFSA and one or more of its staff. In addition, the Contractor is required to implement appropriate mechanisms to deal promptly and effectively with personal data breaches and security incidents. 

