v. carry out data protection impact assessments and prior consultations as necessary. 

9. The Contractor shall maintain a record of all data processing operations carried on behalf of the Data controller , transfers of Personal data , Personal data breaches , responses to requests for exercising rights of people whose is processed and requests for access to Personal data  by third parties. 

10. The Contractor  may only act upon documented written instructions and under the supervision of the Data controller , in particular with regard to the purposes of the processing, the categories of Personal data  that may be processed, the recipients of the Personal data  and the means by which the data subject may exercise its rights. 

11. Without prejudice to paragraph 15 below, the Contractor is not entitled to provide Personal data  to other third parties for whatever purpose without Europol’s prior express written consent. Third parties must also be subject to the conditions set up by Europol. 

12. If Personal data of Europol staff is no longer necessary for the performance of the Framework Contract , it shall be deleted or destroyed in accordance with Europol’s written instructions and such deletion or destruction shall be certified in writing to Europol. 

13. The Contractor  shall notify relevant Personal data breaches  to the Data controller  without undue delay and at the latest within 48 hours after the Contractor  becomes aware of it. This obligation of notification is different to the obligation to notify Personal data breaches  under national law. The Contractor must notify Europol irrespective of whether the national data protection supervisory authority is notified or not. In such cases, the Contractor shall provide the Data controller  with at least the following information: 

i. nature of the Personal data breach  including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Personal Data  records concerned; 

ii. likely consequences of the breach; 

iii. measures taken or proposed to be taken to address the breach, including, where appropriate, measures to mitigate its possible adverse effects. 

The obligations in relation to Personal data  subsist for an unlimited period after the end of this Framework Contract . 

14. The Contractor  shall immediately inform the Data controller if, in its opinion, an instruction infringes Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or other Union or Member State data protection legal provisions as referred to in the tender specifications. 

15. The Contractor shall notify Europol without delay of any legally binding request for disclosure of Personal data processed on its behalf made by any national public authority, including an authority from a third country. The Contractor may not give such access without the prior written authorisation of Europol unless such prior authorisation would place the Contractor in breach of national law. 

16. Europol or an outside body of its choice shall have the right to verify the data protection compliance of the Contractor under the Europol Regulation and Regulation (EU) No 2018/1725. 

17. Europol is subject to Protocol 7 of the Treaty on the Functioning of the European Union on the privileges and immunities of the European Union, particularly as regards the inviolability of archives (including the physical location of data and services as set out in this Article) and data security, which includes Personal data held on behalf of Europol in the premises of the Contractor or subcontractor. 

