New Jersey Data Privacy Act 56:8-166.16(c): Processor confidentiality duty and written subcontractor flow-down

What does 56:8-166.16(c) require?

Notwithstanding the controller's instructions, a processor must ensure each person processing the personal data is subject to a duty of confidentiality, and must engage any subcontractor under a written contract that requires the subcontractor to meet the processor's obligations regarding the data.