11.3. In the course of providing the services, you are a Controller and we are your Processor in respect of any Personal Data, we will:
11.3.1. Process Personal Data in accordance with all applicable law;
11.3.2. Process the Personal Data only on your documented instructions as set out in this Agreement, including with regard to transfers of Personal Data to a third country or an international organisation;
11.3.3. unless prohibited by law, notify you if we are required by any law of the European Union or the law of one of the Member States of the European Union to act other than in accordance with your instructions or if, in our opinion, any of your instructions infringes the Regulation or other Union or Member State data protection provisions;
11.3.4. have your general authorisation to obtain other Processors (“Sub-processors”) and shall respect the conditions referred to in paragraphs 2 and 4 of Article 28 for any such engagement. Subject to the limitations of liability in this agreement, we shall be liable for the acts and omissions of our Sub-processors, and we shall ensure that the Sub-processor contract (as it relates to the Processing of Personal Data) is on terms which are substantially the same as, and in any case no less onerous than, this clause 11;
11.3.5. ensure that persons authorised to Process the Personal Data have committed themselves to confidentiality;
11.3.6. take all measures required pursuant to Article 32;
11.3.7. taking into account the nature of the Processing, assist you, at your cost, by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the Regulation;
11.3.8. .provide, at your cost, reasonable assistance on written request by you in ensuring compliance with your obligations pursuant to Articles 32 to 36, taking into account the nature of Processing and the information available to us;
11.3.9. at your choice and cost, delete or return all the Personal Data to you after the end of the provision of the services relating to the Processing, and delete existing copies unless UK or European Union law requires storage of the Personal Data;
11.3.10. at your cost and following written agreement as to the details, make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you; and
11.3.11. notify you without undue delay if we become aware of a Personal Data Breach for which we are responsible.