Contractor Employee Data Access Control. All Contractor employees shall be adequately screened, commensurate with the sensitivity of their jobs. Contractor agrees to limit employee access to data on a need-to-know basis. Contractor shall impose a disciplinary process for employees not following privacy procedures. Contractor shall have a process to remove access to Protected University Data immediately upon termination or re-assignment of an employee by the Contractor.
Contractor Employee Data Access Control. All Contractor employees shall be adequately screened, commensurate with the sensitivity of their jobs. Contractor agrees to limit employee access to data on a need-to-know basis. Contractor shall impose a disciplinary process for employees not following privacy procedures. Contractor shall have a process to remove access to Protected University Data immediately upon termination or re-assignment of an employee by the Contractor. Data Breach: Contractor shall report to the University any use or disclosure of Protected University Data not authorized by this Agreement or in writing by the University. Contractor shall make the report to the University not more than one (1) business day after Contractor learns of such use or disclosure. Contractor’s report shall identify; (i) the nature of the unauthorized use or disclosure, (ii) the information used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Contractor has done or shall do to mitigate the effects of the unauthorized use or disclosure, and (v) what corrective action Contractor has taken or shall take to prevent future similar unauthorized use or disclosure. Contractor shall provide such other information, including a written report, as reasonably requested by the University. Contractor shall take appropriate steps to remedy such data breach and mitigate, to the extent practicable, any harmful effect that is known to Contractor of a security breach or use or disclosure of Protected University Data by Contractor in violation of the requirements of this agreement. Contractor shall keep University informed on the progress of each step of the incident response. Contractor shall indemnify and hold University harmless from all liabilities, costs and damages arising out of or in any manner connected with the security breach or unauthorized use or disclosure by Contractor of any Protected University Data. Contractor shall mitigate, to the extent practicable, any harmful effect that is known to Contractor of a security breach or use or disclosure of Protected University Data by Contractor in violation of the requirements of this Agreement. In addition to the rights of the Parties established by this Agreement, if the University reasonably determines in good faith that Contractor has materially breached any of its obligations, the University, in its sole discretion, shall have the right to terminate the Agreement immediately.
