4. Confidentiality

The Data Processor shall ensure that only those persons who are currently authorised to do so are
able to access the personal data being processed on behalf of the Data Controller. Access to the data shall therefore without delay be denied if such authorisation is removed or expires.

Only persons who require access to the personal data in order to fulfil the obligations of the Data
Processor to the Data Controller shall be provided with authorisation.

The Data Processor shall ensure that persons authorised to process personal data on behalf of the
Data Controller have undertaken to observe confidentiality or are subject to suitable statutory
obligation of confidentiality.

The Data Processor shall at the request of the Data Controller be able to demonstrate that the
employees concerned are subject to the above confidentiality.