# ANNEX II **Commission Implementing Decision (EU) 2021/915 · binding on its addressees · dated 4 Jun 2021 [in force]** *In force · Commission Implementing Decision (EU) 2021/915, OJ L 199, 7.6.2021 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng)* Description of the processing Categories of data subjects whose personal data is processed ... Categories of personal data processed .... Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. ... Nature of the processing .... Purpose(s) for which the personal data is processed on behalf of the controller ... Duration of the processing ... ... For processing by (sub-) processors, also specify subject matter, nature and duration of the processing