19.4. The data processor who has taken over the responsibility of data collection and processing shall have the following responsibilities, including: 19.4.1. Collect and process data under the supervision of the data controller with the consent from the data subject. 19.4.2. Rectify, change, or erase data in accordance with the duties, directions and instructions given by the data controller 19.4.3. Provide the data controller the necessary information related to data collection and processing. 19.4.4. Maintain data obtained in the course of data collection and processing. 19.4.5. Provide information and results of data processing to the data controller within the period specified in the contract without keeping a copy, and erase the data which was collected for processing without re-use. 19.4.6. Take measures to ensure information security in accordance with Article 20 of this Law. 19.4.7. Perform the duties, directions and instructions given by the data controller within the procedure specified in 18.2.1 of this Law. 19.5. The data processor's violation of the duties, directions and instructions given by the data controller shall not serve as a ground to release the data controller from the obligations and responsibilities to the data subject. CHAPTER FIVE INFORMATION PROTECTION Article 20. Information Security Measures 20.1. The data controller and data processor specified in Paragraph 19.1 of this Law, for information security, shall take the following measures: 20.1.1.Approve and follow internal procedures to ensure information security in accordance with the requirements set forth in Paragraph 20.2 of this Law. 20.1.2. Approve a plan for taking actions for loss of information and notifying the data subject and relevant state authority in accordance with the Law. 20.1.3. Take all measures to ensure the integrity, confidentiality and accessibility of the information system used for data collection, processing, and use. 20.1.4. Approve and follow procedures and guidelines on data use restriction, data erasure and deidentification of data subject. 20.1.5. Conduct an assessment in order to ensure the security of data processing activities. 20.2. The state central administrative body in charge of digital development and communication shall determine the requirements for ensuring information security during data collection, processing and use, instructions for assessment and storage technology requirements. Article 21. Notice to Data Subjects 21.1. The data controller shall immediately provide a notice to the data subject in the following cases: 21.1.1. Use of sensitive personal data.