Contractual standards for Data Processing on Behalf, last revised December 8, 2014 d) If access control (user rights) is not relevant to the services subject to this Agreement, please briefly state the reasons below: (Please use additional sheet if necessary.) 4. Disclosure control Definition: Disclosure control refers to the action taken to ensure that personal data cannot be read, copied, amended, or removed without authorization during electronic transmission, during storage on data media, or during transit on such media, and to ensure that it is possible to establish and review the points at which it is envisaged it will be necessary to transfer personal data using data transfer facilities. a) Who holds overall responsibility for implementing and ensuring compliance with disclosure control? Controller Processor b) What action is taken to implement disclosure control and who carries out this action? (Please select appropriate answers and mark with a cross, as applicable) Co Pr • Forms of data forwarding fully documented (e.g. printout, data media, automated transfer) .......................................................... ☐ ☐ • Data recipients listed (enter under c)) .......................................................................... ☐ ☐ • Interfaces, retrieval and transmission programs documented ...................................... ☐ ☐ • For printouts and data media: o Regular inventory checks carried out ............................................................. ☐ ☐ o Transit security measures implemented (e.g. containers, encrypted storage media, handover records) ................................................. ☐ ☐ • For electronic forwarding: o Data transfer encrypted ................................................................................. ☐ ☐ o Data forwarding or transfer logged ................................................................ ☐ ☐ • Plausibility, completeness, and accuracy checks carried out ....................................... ☐ ☐ Page 12 of 20