Data Protection Act Compliance. E2.1 The Contractor shall (and shall ensure that all of its Staff) comply with any notification requirements under the DPA and both Parties will duly observe all their obligations under the DPA which arise in connection with the Contract.
Data Protection Act Compliance. 11.1 The Authority and the Contractor will observe all their obligations under the DPA which arise in connection with the Contract.
Data Protection Act Compliance. Under the Act, personal and/or sensitive data can only be shared or disclosed by the Data Controller to the Data Processor if, in the case of personal data, at least 1 condition under Schedule 2 (see Appendix 3) is met, or in the case of personal sensitive data at least 1 condition under Schedule 3 (see Appendix 4) is met. It is the responsibility of the Data Controller to obtain requisite authorisation and to inform Data Subjects (as defined under the Act) by means of a privacy notice – formally a ‘fair processing notice’ (as defined in Schedule 1, Part II of the Act – see Appendix 5). In accordance with the Act the Data Controller may disclose data to the Data Processor ‘for the performance of a contract’ and for ‘systematic data sharing’ for the purposes of records management. In the processing of Customer Data Capita and CCS will process the Data strictly in accordance with the instructions provide by the Data Controller and not further or otherwise. Capita and CCS confirm that they have processes in place to ensure that all relevant employees are compliant with the UK Data Protection Act 1998 as amended, and with consideration to the Isle of Man Data Protection Act 2002 and Data Protection (Jersey) Law 2005. Additionally, in line with principles 7 and 8, Capita and CCS place very strict controls around who has visibility of any Customer Data held on their servers. For the investigation and resolution of support incidents involving Customer Data, Capita and CCS may request permission for our offshore teams in India (or other countries without adequacy) to have remote access to the data, but only when anonymised data cannot be used to resolve the issue and under no circumstances is this data ever allowed to be physically transferred and is retained within the Capita Data Centres (all of which are located within the EEA). Access to the Customer Data in these circumstances is provided by a secure remote access solution. Any such access must be approved in advance in writing by the Data Controller/Customer, whether on a per instance basis, or by a signed Data Processing/Sharing Agreement. Please refer to Appendix 6 for samples of the various documents including the European Commission approved ‘model’ clauses.
Data Protection Act Compliance. The Provider shall at all times for the duration of the Contract, comply with the requirements of the Data Protection Act 1998 and associated codes of practice (including Information Security , Risk Management and Records Management ) , and in particular, without prejudice to the generality of the foregoing shall have appropriate technical and organisational security measures in place to prevent unauthorised or unlawful processing of personal information, and to prevent accidental loss, destruction or damage to any personal information they hold or process.
