(2) The data controller and his/her data processor, as the case may be, shall appoint data processor(s) who that provide sufficient guarantees regarding the technical and organizational security measures employed to protect the personal data associated with the processing undertaken and ensure strict adherence to such measures (3) (a) The data controller shall enter into a written contract or any other legal instrument with Any recourse to the data processor which ensures that the data processor maintains security measures on personal data. shall be governed by a contract or any other legal instrument which in legal terms, associates the data processor to the data controller. (b) The contract or legal instruments islative act shall establish: (i) that the data processor acts only under instruction of the data controller; (ii) that the data processor is additionally, responsible for discharging the duties set out in previous paragraph (1) associated with the data processor’s processing. Security breach notification 25. (1) The data controller or his/her representative shall must notify the Authority, without any undue delay, of any security breach affecting personal data he/she processes on behalf of the data controller. (2) The data processor shall must notify the data controller, without undue delay, of any security breach affecting personal data he/she processes on behalf of the data controller. Obligation of 26. notification to the Authority (1) (a) Prior to any wholly or partly automated operation or set of operations intended to serve a single purpose or several related purposes, the controller or his/her representative, if any, must notify the Authority. (b) Any modification to the information provided according to Section 27 must be notified to the Authority. (2) The provisions of Previous Paragraph (1) shall does not apply to operations having the sole purpose of keeping a register that is intended to provide information to the public by virtue of an act, decree or ordinance and that is open to consultation either by the general public or by any person demonstrating a legitimate interest. Draft Data Protection Bill Version 1.0 35