Controller Processor Relationship. Other than as set forth in Section 3.2 below, Medidata shall only Process Personal Data on behalf of the Customer. The parties acknowledge that with regard to the Processing of Personal Data as between the parties, Customer acts as the Data Controller and Medidata acts as the Data Processor (e.g., even where Customer is a data processor on behalf of another data controller, as between the parties to this Agreement, Customer will act as the Data Controller).
Controller Processor Relationship. 11.1.1. The Parties agree that the Client is the Data Controller and the Supplier is the Data Processor.
11.1.2. The Supplier will ensure that all its employees, sub-contractors and their personnel comply with all relevant data protection laws.
11.1.3. The Supplier may from time to time subcontract processing of the Data to a third party subcontractor (sub-Processors) without the specific written consent of the Client, in cases such as repairs to data centres, switching of certain service providers (e.g. hardware providers, software providers or providers of other services related to Cloud Computing) as these instances would be classed as being in the legitimate interest of the Data Controller (Recital 49 of the UK-GDPR) and other exemptions made by the Information Commissioner’s Office for Cloud providers. The Supplier reserves the right to sub-contract vetted technical specialists for the occasional and/or regular provision of certain cloud-related services without the Client’s consent.
11.1.4. Subject to paragraph 11.1.3, for all other sub-processing activities the Supplier will only engage a sub-Processor with the prior written consent of the Data Controller (the Client) and a written contract which enforces compliance with data protection laws on the sub- processor.
11.1.5. The Supplier will not transfer or store any data belonging to the Client outside of the UK without express written instructions from the Client, unless required by law to do so.
11.1.6. Although the Supplier in its capacity as Processor will provide any reasonable assistance in the handling of Subject Access Requests (SARs), the Client in its capacity as Controller remains ultimately responsible for the handling of SARs. Any such assistance shall be scoped and charged for separately.
11.1.7. Although the Supplier in its capacity as Processor will provide any reasonable assistance in the performing of Data Protection Impact Assessments (DPIAs) the Client in its capacity as Controller remains ultimately responsible for the performing of its own DPIAs. Any such assistance shall be scoped and charged for separately.
11.1.8. Nothing within this Contract relieves either of the Parties of their own direct responsibilities and liabilities under the UK-GDPR; and no indemnity has been granted.
