4.5.2016 Official Journal of the European Union EN L 119/115 (e) makes available to the controller all information necessary to demonstrate compliance with this Article; (f) complies with the conditions referred to in paragraphs 2 and 3 for engaging another processor. 4. The contract or the other legal act referred to in paragraph 3 shall be in writing, including in an electronic form. 5. If a processor determines, in infringement of this Directive, the purposes and means of processing, that processor shall be considered to be a controller in respect of that processing. Article 23 Processing under the authority of the controller or processor Member States shall provide for the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, not to process those data except on instructions from the controller, unless required to do so by Union or Member State law. Article 24 Records of processing activities 1. Member States shall provide for controllers to maintain a record of all categories of processing activities under their responsibility. That record shall contain all of the following information: (a) the name and contact details of the controller and, where applicable, the joint controller and the data protection officer; (b) the purposes of the processing; (c) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations; (d) a description of the categories of data subject and of the categories of personal data; (e) where applicable, the use of profiling; (f) where applicable, the categories of transfers of personal data to a third country or an international organisation; (g) an indication of the legal basis for the processing operation, including transfers, for which the personal data are intended; (h) where possible, the envisaged time limits for erasure of the different categories of personal data; (i) where possible, a general description of the technical and organisational security measures referred to in Article 29(1). 2. Member States shall provide for each processor to maintain a record of all categories of processing activities carried out on behalf of a controller, containing: (a) the name and contact details of the processor or processors, of each controller on behalf of which the processor is acting and, where applicable, the data protection officer; (b) the categories of processing carried out on behalf of each controller; (c) where applicable, transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation; (d) where possible, a general description of the technical and organisational security measures referred to in Article 29(1).