If your company contracts third parties (sub-processors) to process personal data on behalf of Vattenfall, the content of this letter is pertinent to these parties as well. Vattenfall and your company have agreed that the obligations arising from the processor agreement also apply to any third parties contracted by your company.
The obligations regarding the statutory duty to report data leaks therefore also apply to these third parties. You must ensure that you conclude effective (written) agreements with any third parties, so that you are adequately informed in good time of any breaches of security or data leaks.