The processor and its subcontractors involved in the processing of personal data shall at all times comply with the minimum security requirements set out in Appendix 2. In the event that such a request, correspondence, request or complaint is addressed directly to the processor, the processor must immediately inform the data controller and provide all details….