Security measures. 6.1 Otherside must adopt all appropriate technical and organisational measures to secure the Per- sonal Data against loss, destruction, or any form of unlawful processing. These measures must be ap- propriate, taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. These measures are at least aimed at:
Security measures. The subcontractor undertakes to implement the following security measures: […] The subcontractor undertakes upon completing data processing service delivery to: • erasing all personal data, or • sending back all personal data to the controller, or • forwarding the personal data to the subcontractor designated by the controller. Such dispatch is accompanied by the erasure of all existing copies in the data systems of the subcontractor. After erasure, the subcontractor shall substantiate the erasure in writing. The subcontractor shall communicate to the controller the name and contact details of his Data Protection Officer, if he has designated one in accordance to Article 37 of the European Data Protection Regulation.