In addition to and notwithstanding any other right or obligation arising under these terms and conditions each party shall (and shall ensure that its staff and contractors shall):
- a)
taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk to the rights and freedoms of natural persons implement all appropriate technical and organisational measures necessary or desirable to ensure that personal data is protected against loss, destruction and damage, and against unauthorised access, use, modification, disclosure or other misuse and to ensure protection of the rights of data subjects in accordance with Data Protection Laws;
- b)
take all reasonable steps to ensure the reliability and trustworthiness of staff which will have access to any personal data;
- c)
assist the other in ensuring compliance with its obligations pursuant to Articles 32 to 36 of the UK GDPR, taking into account the nature of processing and the information available to the relevant party and any other processors;
- d)
comply with Article 26 of the UK GDPR where the parties act as joint controllers;
- e)
process the personal data obtained from the other strictly only for the purposes of fulfilling its obligations under these terms and conditions;
- f)
ensure that it has in place all necessary notices and consents to enable lawful transfer of personal data to the other party;
- g)
to the extent that the relevant party is acting as a processor comply with the express instructions or directions of the controller in connection with the processing of such personal data and the requirements of any Data Protection Laws and specifically not otherwise modify, amend, combine with other personal data or alter the contents of the personal data or disclose or permit the disclosure of any of the personal data to any third party (including the data subject) unless specifically authorised in writing by the controller or required to do so under Data Protection Laws (in such case the processor shall inform the controller of that legal requirement before processing, unless prohibited from doing so on grounds of public interest);
- h)
promptly comply with any request from the controller requiring the processor to amend, transfer or delete the personal data; and without prejudice to the above, the processor shall, at the controller’s direction, return or delete all personal data immediately upon the suspension or termination of the accreditation, unless Data Protection Laws require ongoing storage of such data;
- i)
consider all suggestions made by the other to ensure that the level of protection provided for personal data is in accordance with these terms and conditions and to make the changes suggested unless they can prove to the other’s reasonable satisfaction that they are not necessary or desirable to ensure ongoing compliance with these terms and conditions;
- j)
not disclose personal data without the controller’s prior written authority;
- k)
not do or omit to do anything which causes the other to breach any Data Protection Laws or contravene the terms of any registration, notification or authorisation under any Data Protection Laws;
- l)
take all reasonable steps to ensure the reliability of any of their personnel who have access to the personal data;
- m)
ensure that only those of their personnel who need to have access to the personal data are granted access to it and only for the purposes of the performance of these terms and conditions and ensure that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality;
- n)
not transfer personal data which has been obtained by or made available to it to any country outside the United Kingdom without the prior written consent of the other, such consent may be subject to and given on such terms as the other may in its reasonable discretion prescribe.
In the event that the other party consents to the transfer of personal data outside the United Kingdom, the transfer shall only be made where it is covered by UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) to ensure that the personal data is processed in accordance with the Data Protection Laws;
- o)
not engage another processor without the prior written authorisation of the controller. The processor shall notify the controller of any intended changes concerning the addition or replacement of other processors. If, within fifteen (15) days of receipt of such notice, the controller notifies the processor in writing of any objections (on reasonable grounds) to the proposed appointment of another processor, the processor shall not appoint the proposed processor until reasonable steps have been taken to address the objections raised by controller and the controller has been provided with a reasonable written explanation of the steps taken;
- p)
where engaging another processor for carrying out processing activities on behalf of the controller, ensure the same data protection obligations as set out in these terms and conditions shall be imposed on that other processor and shall remain fully liable to the controller for the performance of that other processor’s obligations;
- q)
make available to the other, at the other’s expense, all information reasonably necessary to demonstrate compliance with Data Protection Laws and allow for and contribute to audits, including inspections, conducted by the other or another auditor mandated by the other after reasonable notice.
