All of these principles are then set out in a framework procedure and procedures specific to each subject (e.g., procedure for exercising the rights of data subjects, procedure in the event of personal data breaches, procedure for the qualification of and contracting with third parties, and procedure for internal control by the DPO).