DATA PROCESSING PRINCIPLES. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.
DATA PROCESSING PRINCIPLES. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter. Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller. Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectifi...
DATA PROCESSING PRINCIPLES. 4.1 The Affiliate shall comply with the Data Protection Laws and shall process ISTQB Personal Data only upon and in accordance with the (written) instructions from ISTQB.
4.2 The Affiliate shall maintain confidential all ISTQB Personal Data, including in accordance with the provisions set out under clause 4 of the ISTQB Affiliate and Non-Disclosure Agreement and in accordance with Data Protection Laws OC_BE/335893.1
4.3 The Affiliate shall comply with all ISTQB policies relating to the processing of Personal Data (including without limitation security policies, IT policies etc.), as these may be implemented, updated, supplemented or amended from time to time.
4.4 The Affiliate shall participate in and follow any training relating to the processing of Personal Data (including but not limited to IT security trainings) provided by or on behalf of ISTQB.
4.5 According to the GDPR (article 5) Personal Data must be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject;
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
4.6 The Affiliate shall access and process ISTQB Personal Data only to the extent strictly needed for the performance of his/her function(s) and obligations under the Affiliate and Non-Disclosure Agreement and always in accordance with the provisions of this Data Protection Policy Appendix and the Data Protection Laws (including but not limited to the abovementioned principles under section 4.5).
4.7 The Affiliate shall not process ISTQB Personal Data in a way that may violate, jeopardize or otherwise breach the confidentiality, integrity, quality of the Personal Data or o...
DATA PROCESSING PRINCIPLES. 1. Purpose limitation: Personal data transferred by the FRC to the PCAOB may be processed by the PCAOB itself only to fulfil its audit regulatory functions in accordance with the Xxxxxxxx- Xxxxx Act, i.e., for the purposes of auditor oversight, inspections and investigations of registered audit firms and their associated persons subject to the regulatory jurisdiction of the PCAOB and the FRC. The onward sharing, including the purpose for such sharing, of such data by the PCAOB, will be consistent with the Xxxxxxxx-Xxxxx Act and is governed by paragraph 7 below. The PCAOB will not process personal data it receives from the FRC for any purpose other than as set forth in this Agreement.
2. Data quality and proportionality: The Parties shall make all reasonable efforts to ensure that the personal data transferred by one Party to the other is adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed. A Party will inform the other Party without undue delay if it learns that previously transmitted or received information is inaccurate and/or must be updated. In such case, the Parties will make any appropriate corrections to their respective files, having regard to the purposes for which the personal data have been transferred, which may include supplementing, erasing, restricting the processing of, correcting or otherwise rectifying the personal data as appropriate.
