16 Additional obligations of the processors Personal Data Protection Act, No. 9 of 2022 22. (1) Where a processor is engaged in processing activities on behalf of the controller, the processor shall– (a) ensure that processing activities are carried out only on the written instructions of the controller; (b) ensure that its personnel are bound by contractual obligations on confidentiality and secrecy by the implementation of appropriate technical and organizational measures; (c) facilitate the controller to carry out compliance audits, including inspections upon the written request of the controller, taking into account the nature of processing and the information available to the processor; and (d) upon the written instructions of the controller, erase existing copies of personal data or return all personal data to the controller after the completion of the provisions of services relating to processing. (2) Where a processor fails to comply with the provisions of paragraph (a) of subsection (1) or determines the purposes and means of processing by itself, such processor shall, for the purposes of this Act be deemed to be a controller, in respect of such processing. (3) Where a processor engages another processor (hereinafter referred to as the “sub processor”) for carrying out specific processing activities, the provisions of this section shall apply to and in relation to such sub processor. (4) Where a sub processor fails to fulfil its obligations under subsection (3), the processor shall be liable to the controller for the performance or carrying out of the obligations of such sub processor.