Application of Protective Measures. 1.22.1 Supplier shall apply Protective Measures aimed at preventing accidental or unlawful destruction, loss, alteration or unauthorized disclosure or access to Buyer Personal Data and Service Personal Data as set forth in the security document to be included in Annex 1 of Schedule 7 (GDPR Information) or as otherwise referenced or included within the Call-Off Contract.
1.22.2 Buyer expressly acknowledges that:
(i) the Protective Measures defined and applied by Supplier are based on the instructions and information it has received from Buyer which are used to assess and evaluate, with Buyer the risks associated with the processing of Buyer Personal Data and Service Personal Data;
(ii) it has reviewed the Protective Measures set out in the security document and deems them adequate taking into consideration the risks of the processing and the defined purposes of the processing.
(iii) where the Buyer rejects the Supplier’s Protective Measures or directs the Supplier to implement Protective Measures that, in either case, are a lower standard than that which the Supplier has recommended, the Supplier shall not be held liable or responsible for any Data Loss Events or Personal Data Breaches that occur as a result thereto and the Buyer shall indemnify, defend and hold the Supplier harmless from and against any and all claims, losses, liabilities, costs, expenses (including reasonable legal fees) and damages in connection thereto.
1.22.3 The Buyer understands that the Protective Measures are subject to technical progress and further development. In this respect, the Supplier shall be permitted to modify or to use alternative suitable measures save that the Supplier will not materially decrease the overall security of the Services during the term of the Call-Off Contract without the prior written consent of the Buyer.
