Article 25 of the Data Protection Act and the Regulatory Decree establish the responsibilites and obligations of data processors. Among other obligations, they must follow the controller's instruction, comply with the Data Protection Law, protect the confidentiality and destroy the data once the obligations have been fulfilled.