Article 6c (processor).

• 1

  If the controller has police data processed on its behalf by a processor, it shall only use a processor that adequately ensures that appropriate technical and organizational measures and procedures are implemented in such a way that the processing complies with the provisions of or pursuant to this Act and that the rights of the data subject are safeguarded.

• 2

  The performance of processing operations by a processor shall be governed by a written contract or other legal act binding the processor to the controller. Further rules on the content of the contract or legal act shall be laid down by or pursuant to a general order in council.

• 3

  The processor and anyone acting under the control of the controller or of the processor shall process police data only in accordance with the controller's instructions, unless he is required to do so by national or Union law.

• 4

  The processor shall not hire any other processor except with the prior written consent of the controller. In the case of a general written consent, the processor shall inform the controller of the addition or replacement of other processors, with the possibility of objection by the controller.

• 5

  The processor shall notify the controller of a security breach without undue delay.