10. Data
Protection and Data Processing
10.1 Both
parties will comply with all applicable requirements of the Data Protection
Legislation. This Clause 9 is in
addition to, and does not relieve, remove or replace, a party's obligations
under the Data Protection Legislation. In this Clause Applicable Laws means
(for so long as and to the extent that they apply to the Contractor) the law of
the European Union, the law of any member state of the European Union and/or
Domestic UK Law; and Domestic UK Law means the UK Data Protection Legislation
and any other law that applies in the UK.
10.2 The
parties acknowledge that for the purposes of the Data Protection Legislation,
the Business is the data controller and the Sub-Contractor is the data
processor (where Data Controller and Data Processor have the meanings as
defined in the Data Protection Legislation).
10.3 Without
prejudice to the generality of Sub- clause 9.1, the Business will ensure that
it has all necessary appropriate consents and notices in place to enable lawful
transfer of the Personal Data (as defined in the Data Protection Legislation)
to the Sub-Contractor for the duration and purposes of the Contract.
10.4 Without
prejudice to the generality of Sub-clause 9.1, the Sub-Contractor shall, in
relation to any Personal Data processed in connection with the performance by
the Sub-Contractor of its obligations under the Contract:
10.4.1 Process
that Personal Data only on the written instructions of the Business unless the
Sub-Contractor is required by Applicable Laws to otherwise process that
Personal Data. Where the Sub-Contractor is relying on laws of a member of the
European Union or European Union law as the basis for processing Personal Data,
the Sub-Contractor shall promptly notify the Business of this before performing
the processing required by the Applicable Laws unless those Applicable Laws
prohibit the Sub-Contractor from so notifying the Business;
10.4.2 Ensure
that it has in place appropriate technical and organisational measures,
reviewed and approved by the Business, to protect against unauthorised or
unlawful processing of Personal Data and against accidental loss or destruction
of, or damage to, Personal Data, appropriate to the harm that might result from
the unauthorised or unlawful processing or accidental loss, destruction or
damage and the nature of the data to be protected, having regard to the state
of technological development and the cost of implementing any measures (those
measures may include, where appropriate, pseudonymising and encrypting Personal
Data, ensuring confidentiality, integrity, availability and resilience of its
systems and services, ensuring that availability of and access to Personal Data
can be restored in a timely manner after an incident, and regularly assessing
and evaluating the effectiveness of the technical and organisational measures
adopted by it);
10.4.3 Ensure
that all personnel who have access to and/or process Personal Data are obliged
to keep the Personal Data confidential; and
10.4.4 Not
transfer any Personal Data outside of the European Economic Area unless the
prior written consent of the Business has been obtained and the following
conditions are fulfilled:
i.
The Business or the Sub-Contractor has provided
appropriate safeguards in relation to the transfer;
ii.
The Data Subject (as defined in the Data
Protection Legislation) has enforceable rights and effective legal remedies;
iii.
The Sub-Contractor complies with its
obligations under the Data Protection Legislation by providing an adequate
level of protection to any Personal Data that is transferred; and
iv.
The Sub-Contractor
complies with reasonable instructions notified to it in advance by the Business
with respect to the processing of the Personal Data;
10.4.5 Assist
the Business, at the Business' cost, in responding to any request from a Data
Subject and in ensuring compliance with its obligations under the Data
Protection Legislation with respect to security, breach notifications, impact
assessments and consultations with supervisory authorities or regulators;
10.4.6 Notify
the Business without undue delay on becoming aware of a Personal Data breach;
10.4.7 At
the written direction of the Business, delete or return Personal Data and
copies thereof to the Business on termination of the agreement unless required
by Applicable Law to store the Personal Data; and
10.4.8 Maintain
complete and accurate records and information to demonstrate its compliance
with this Clause 9.
10.5 The
Business does not consent to the Sub-Contractor appointing any third-party
processor of Personal Data under the Contract.
10.6 Either
party may, at any time on not less than 30 days' notice, revise this Clause 9
by replacing it with any applicable controller to processor standard clauses or
similar terms forming part of an applicable certification scheme (which shall
apply when replaced by attachment to the Contract).