SPECIAL CONDITIONS: DATA PROCESSOR SCHEDULE
DEFINITIONS
Data Controller: has the meaning set out in section 1(1) of the Data Protection Act 1998.
Data Subject: an individual who is the subject of Personal Data.
Personal Data: has the meaning set out in section 1(1) of the Data Protection Act 1998 and
relates only to personal data, or any part of such personal data, of which the Customer is the
Data Controller and in relation to which the Supplier is providing services under the Contract.
Processing and process: have the meaning set out in section 1(1) of the Data Protection Act
1998.
1.
1.1
1.2
1.3
1.4
1.5
1.6
1.7
OBLIGATIONS OF THE SUPPLIER
The Customer and the Supplier acknowledge that for the purposes of the Data
Protection Act 1998, the Customer is the Data Controller and the Supplier is the data
Supplier of any Personal Data. The Supplier further acknowledges and agrees that all
rights, title and interest in and to the Personal Data including any copyright and
database rights vest in the Customer. All updates and additions to the Personal Data
made, obtained or processed by the Supplier in the course of or in connection with the
Contract shall form part of the Personal Data and belong to the Customer.
The Supplier shall process the Personal Data only to the extent, and in such a manner,
as is necessary for the purposes specified in the Contract and in accordance with the
Customer’s instructions from time to time and shall not process the Personal Data for
any other purpose. The Supplier will keep a record of any processing of personal data
it carries out on behalf of the Customer.
The Supplier shall promptly comply with any request from the Customer requiring
the Supplier to amend, transfer or delete the Personal Data.
Where the Contract requires the Supplier to collect any Personal Data on behalf of the
Customer it shall only do so on terms specifically agreed with the Customer which
will contain a data protection notice informing the data subject of the identity of the
Data Controller, the identity of any data protection representative it may have
appointed, the purposes or purposes for which their Personal Data will be processed
and any other information which is necessary having regard to the specific
circumstances in which the data is, or is to be, processed to enable processing in
respect of the data subject to be fair. The Supplier shall not modify or alter the terms
in any way without the prior written consent of the Customer.]
If the Supplier receives any complaint, notice or communication which relates
directly or indirectly to the processing of the Personal Data or to either party's
compliance with the Data Protection Act 1998 and the data protection principles set
out therein, it shall immediately notify the Customer and it shall provide the
Customer with full co-operation and assistance in relation to any such complaint,
notice or communication.
At the Customer's request, the Supplier shall provide to the Customer a copy of all
Personal Data held by it in the format and on the media reasonably specified by the
Customer.
The Supplier shall not transfer the Personal Data outside the UK without the prior
written consent of the Customer. Any transfer of Personal data outside the European
401291754
1
1.8
2.
2.1
2.2
2.3
3.
3.1
3.2
3.3
4.
4.1
4.2
5.
5.1
5.2
6.
6.1
Economic Area requires the specific approval of the Customer’s Data Protection
Officer.
The Supplier shall promptly inform the Customer if any Personal Data is lost or
destroyed or becomes damaged, corrupted, or unusable. The Supplier will restore
such Personal Data at its own expense.
SUPPLIER'S EMPLOYEES
The Supplier shall ensure that access to the Personal Data is limited to:
(a)
those employees who need access to the Personal Data to meet the
Supplier's obligations under the Contract; and
(b)
in the case of any access by any employee, such part or parts of the Personal
Data as is strictly necessary for performance of that employee's duties.
The Supplier shall ensure that all employees:
(a)
are informed of the confidential nature of the Personal Data;
(b)
have undertaken training in the laws relating to handling personal data; and
(c)
are aware both of the Supplier's duties and their personal duties and
obligations under such laws and the Contract.
The Supplier shall take reasonable steps to ensure the reliability of any of the
Supplier's employees who have access to the Personal Data.
RIGHTS OF THE DATA SUBJECT
The Supplier shall notify the Customer within 3 working days if it receives a request
from a Data Subject for access to that person's Personal Data.
The Supplier shall provide the Customer with full co-operation and assistance in
relation to any request made by a Data Subject to have access to that person's
Personal Data.
The Supplier shall not disclose the Personal Data to any Data Subject or to a third
party other than at the request of the Customer or as provided for in the Contract.
RIGHTS OF THE CUSTOMER
The Customer is entitled, on giving at least 5 working days' notice to the Supplier, to
inspect or appoint representatives to inspect all facilities, equipment, documents and
electronic data relating to the processing of Personal Data by the Supplier.
The requirement under clause 4.1 to give notice will not apply if the Customer
believes that the Supplier is in breach of any of its obligations under the Contract.
WARRANTIES
The Supplier warrants that:
(a)
it will process the Personal Data in compliance with all applicable laws,
enactments, regulations, orders, standards and other similar instruments; and
(b)
it will take appropriate technical and organisational measures against the
unauthorised or unlawful processing of personal data and against the
accidental loss or destruction of, or damage to, personal data to ensure the
Customer's compliance with the seventh data protection principle.
The Supplier shall notify the Customer immediately if it becomes aware of any
unauthorised or unlawful processing, loss of, damage to or destruction of the Personal
Data;
INDEMNITY
The Supplier agrees to indemnify and keep indemnified and defend at its own
expense the Customer against all costs, claims, damages or expenses incurred by the
401291754
2
7.
7.1
8.
8.1
Customer or for which the Customer may become liable due to any failure by the
Supplier or its employees or agents to comply with any of its obligations under the
Contract.
APPOINTMENT OF SUBCONTRACTORS
The Supplier may only authorise a third party (sub-contractor) to process the
Personal Data:
(a)
subject to the Customer's prior written consent where the Supplier has
supplied the Customer with full details of such sub-contractor;
(b)
provided that the sub-contractor's contract is on terms which are
substantially the same as those set out in the Contract; and
(c)
provided that the sub-contractor's contract terminates automatically on
termination of the Contract for any reason.
POST-TERMINATION OF THE CONTRACT
On termination of the Contract or any earlier termination of the Supplier’s right or
obligation to process Personal Data, and as otherwise directed by the Customer, the
Supplier shall either:
(a)
Destroy the Personal Data and all copies thereof;
(b)
Transfer the Personal data to the Customer or such other third party as the
Customer may direct; or
(c)
Archive the Personal data subject to agreement on terms of archiving
including costs.
End
401291754
3