Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA are separate Data Controllers in common of any personal data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future. 8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times: 8.2.1. Comply with the DP Legislation including without limitation (to the extent relevant and as set out in the DP Legislation) any obligations as to registration as a Data Controller, principles and requirements for data protection and restrictions on processing of personal data, and requirements as to notification of data breaches. 8.2.2. Fully co-operate with each other to enable the other party to comply with the DP Legislation. 8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall: 8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP Legislation; 8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliates, agents and contractors comply with the DP Legislation and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data; 8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual; 8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation; 8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and: 8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and 8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or 8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xx. 8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users: 8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses; 8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology; 8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to: 8.3.7.1. an information notice, or any other notice served on the Organisation by the Information Commissioner; 8.3.7.2. any formal complaint from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Data; and 8.3.7.3. any investigation of any breach or alleged breach of the DP Legislation; 8.3.8. The Parties agree that all uses of Xxxxx Plus Data are for statistical purposes in accordance with article 89 of the GDPR and anticipate that any legislation based on the Data Protection Xxxx which had its first reading in the House of Lords on 13 September 2017 will contain derogations from the requirements of articles 15, 16, 18 and 21 of the GDPR. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. HESA Services shall include within the Xxxxx Plus Operational Documentation guidance on responding to requests to exercise a right under articles 15,16,17,18 or 21 in respect of Xxxxx Plus Data and the Organisation shall have regard to the Xxxxx Plus Operational Documentation in determining how to respond to a request to exercise a right under articles 15,16,17,18 or 21. 8.3.9. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed. 8.3.10. Without prejudice to the generality of clause 8.3.9, in ensuring the security of Unrounded Data relating to individuals the Organisation shall: 8.3.10.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above; 8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and 8.3.10.3. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by: 8.3.10.3.1. completing an Information Security Questionnaire prior to entering into this Agreement; 8.3.10.3.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and 8.3.10.3.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes. 8.3.11. Promptly report to HESA Services any circumstance that it becomes aware of which: 8.3.11.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 or 8.3.10 have not been complied with; 8.3.11.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation as a result of processing carried out in connection with this Agreement; or 8.3.11.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data in connection with this Agreement. 8.4. With regard to the storage and retention of Unrounded Data relating to individuals: 8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals; 8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely; 8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
Appears in 2 contracts
Samples: Organisational Agreement for Access to Heidi Plus, Organisational Agreement for Access to Heidi Plus
Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA are separate Data Controllers in common of any personal data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future.
8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times:
8.2.1. Comply with the DP Legislation including without limitation (to the extent relevant and as set out in the DP Legislation) any obligations as to registration as a Data Controller, principles and requirements for data protection and restrictions on processing of personal data, and requirements as to notification of data breaches.
8.2.2. Fully co-operate with each other to enable the other party to comply with the DP Legislation.
8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall:
8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP Legislation;
8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliates, agents and contractors comply with the DP Legislation and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data;
8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual;
8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation;
8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and:
8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and
8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or
8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xx.
8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users:
8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses;
8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology;
8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to:
8.3.7.1. an information notice, or any other notice served on the Organisation by the Information Commissioner;
8.3.7.2. any formal complaint from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Data; and
8.3.7.3. any investigation of any breach or alleged breach of the DP Legislation;
8.3.8. The Parties agree that all uses of Xxxxx Plus Data are for statistical purposes in accordance with article 89 of the GDPR and anticipate that any legislation based on subject to the Data Protection Xxxx which had its first reading in the House of Lords on 13 September 2017 will contain derogations from the requirements of articles 15, 16, 18 and 21 of the GDPRGDPR set out in schedule 2, part 6, paragraph 27 of the Data Protection Xxx 0000. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. HESA Services shall include within the Xxxxx Plus Operational Documentation guidance on responding to requests to exercise a right under articles 15,16,17,18 or 21 in respect of Xxxxx Plus Data and the Organisation shall have regard to the Xxxxx Plus Operational Documentation in determining how to respond to a request to exercise a right under articles 15,16,17,18 or 21.
8.3.9. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed.
8.3.10. Without prejudice to the generality of clause 8.3.98.3.10, in ensuring the security of Unrounded Data relating to individuals the Organisation shall:
8.3.10.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above;
8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and
8.3.10.3. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by:
8.3.10.3.1. completing an Information Security Questionnaire prior to entering into this Agreement;
8.3.10.3.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and
8.3.10.3.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes.
8.3.11. Promptly report to HESA Services any circumstance that it becomes aware of which:
8.3.11.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 or 8.3.10 have not been complied with;
8.3.11.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation as a result of processing carried out in connection with this Agreement; or
8.3.11.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data in connection with this Agreement.
8.4. With regard to the storage and retention of Unrounded Data relating to individuals:
8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time time. Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals;
8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely;
8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
Appears in 1 contract
Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA they are separate Data Controllers in common of any personal data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future.
8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times:
8.2.1. Comply with the DP Legislation Act including without limitation (to the extent relevant and as set out in relevant) the DP Legislation) any obligations as to registration as a Data Controller, principles Controller and requirements for the data protection and restrictions on processing of personal data, and requirements as to notification of data breachesprinciples set out in the DP Act.
8.2.2. Fully co-operate with each other to enable the other party to comply with the DP LegislationAct.
8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall:
8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP LegislationAct;
8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliatesAffiliates, agents and contractors comply with the DP Legislation Act and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data;
8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual;
8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation;
8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and:
8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and
8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or
8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xx.
8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users:
8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses;
8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology;
8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to:
8.3.7.1. an information notice, or any other notice (including in particular any deregistration, enforcement or transfer prohibition notice) served on the Organisation by the Information Commissioner;
8.3.7.2. any formal complaint complaints from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Datadata subjects; and
8.3.7.3. any investigation of any breach or alleged breach of the DP LegislationAct;
8.3.8. The Parties agree that all uses of Where the Organisation receives a subject access request which relates or refers specifically to data within Xxxxx Plus Data are (not including any subject access request for statistical purposes all personal data held by the Organisation in accordance with article 89 of relation to the GDPR and anticipate that any legislation based on requesting data subject), the Data Protection Xxxx which had its first reading in Organisation shall not respond to the House of Lords on 13 September 2017 will contain derogations from subject access request itself but shall pass the requirements of articles 15, 16, 18 and 21 of the GDPR. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. subject access request to HESA Services who will respond.
8.3.9. Where the Organisation receives a subject access request which relates to all personal data held by the Organisation in relation to the requesting data subject but does not relate or refer specifically to data held within Xxxxx Plus:
8.3.9.1. the Organisation shall respond to the subject access request; and
8.3.9.2. the Organisation shall include within in its response the following wording: "As specified in our fair processing information, we provide some data that we hold about students and staff in our organisation to the Higher Education Statistics Agency Ltd (HESA) (xxx.xxxx.xx.xx). A subset of this data is included in the Xxxxx Plus Operational Documentation guidance on responding database provided by HESA Services Ltd (HESA's wholly-owned subsidiary), to requests to exercise a right under articles 15,16,17,18 or 21 which we subscribe and which can be accessed by some of our staff who need the data for their work and have had appropriate training in respect of information security. Xxxxx Plus Data includes data relating to individuals who have undertaken higher education courses in the UK and the Organisation shall have regard to the staff working for higher education providers. Any data which we can access through Xxxxx Plus Operational Documentation in determining how to respond does not include names and identifiers but could potentially be identifiable data to a request third party who already has other information about the individual. Access to exercise a right this data is granted under articles 15,16,17,18 or 21.strict contractual terms for specific purposes relating to research, administration and equal opportunities monitoring. If you require further information about any data relating to you which may be held within Xxxxx Plus, please contact HESA Services Ltd by emailing xxxx.xxxxxxxxxx@xxxx.xx.xx"
8.3.98.3.10. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed.
8.3.108.3.11. Without prejudice to the generality of clause 8.3.98.3.10, in ensuring the security of Unrounded Data relating to individuals the Organisation shall:
8.3.10.18.3.11.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact User Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above;
8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and
8.3.10.38.3.11.2. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by:
8.3.10.3.18.3.11.2.1. completing an Information Security Questionnaire information security questionnaire in a format requested by HESA Services and submit it to HESA Services (“the Questionnaire”) prior to entering into this Agreement;
8.3.10.3.28.3.11.2.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and
8.3.10.3.38.3.11.2.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes.
8.3.118.3.12. Promptly report to HESA Services any circumstance that it becomes aware of which:
8.3.11.18.3.12.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 8.3.10 or 8.3.10 8.3.11 have not been complied with;
8.3.11.28.3.12.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation Act as a result of processing carried out in connection with this Agreement; or
8.3.11.38.3.12.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data in connection with this Agreement.
8.4. With regard to the storage and retention of Unrounded Data relating to individuals:
8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals;
8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely;
8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
Appears in 1 contract
Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA are separate Data Controllers in common of any personal data Personal Data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future.
8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times:
8.2.1. Comply with the DP Legislation including without limitation (to the extent relevant and as set out in the DP Legislation) any obligations as to registration as a Data Controller, principles and requirements for data protection and restrictions on processing of personal dataPersonal Data, and requirements as to notification of data breaches.
8.2.2. Fully co-operate with each other to enable the other party to comply with the DP Legislation.
8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall:
8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP Legislation;
8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliates, agents and contractors comply with the DP Legislation and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data;
8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual;
8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation;
8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and:
8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and
8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or
8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xxxxxx.xxxxxxxxxx@xxxx.xx.xx.
8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users:
8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses;
8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology;
8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to:
8.3.7.1. an information notice, or any other notice served on the Organisation by the Information Commissioner;
8.3.7.2. any formal complaint from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Data; and
8.3.7.3. any investigation of any breach or alleged breach of the DP Legislation;
8.3.8. The Parties agree that all uses of Xxxxx Plus Data are for statistical purposes in accordance with article 89 of the GDPR and anticipate that any legislation based on the Data Protection Xxxx Xxx 0000 which had its first reading in the House of Lords on 13 September 2017 will contain contains derogations from the requirements of articles 15, 16, 18 and 21 of the GDPR. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. HESA Services shall include within the Xxxxx Plus Operational Documentation guidance on responding to requests to exercise a right under articles 15,16,17,18 or 21 in respect of Xxxxx Plus Data and the Organisation shall have regard to the Xxxxx Plus Operational Documentation in determining how to respond to a request to exercise a right under articles 15,16,17,18 or 21.
8.3.9. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed.
8.3.10. Without prejudice to the generality of clause 8.3.9, in ensuring the security of Unrounded Data relating to individuals the Organisation shall:
8.3.10.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above;
8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and
8.3.10.3. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by:
8.3.10.3.1. completing an Information Security Questionnaire prior to entering into this Agreement;
8.3.10.3.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and
8.3.10.3.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes.
8.3.11. Promptly report to HESA Services any circumstance that it becomes aware of which:
8.3.11.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 or 8.3.10 have not been complied with;
8.3.11.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation as a result of processing carried out in connection with this Agreement; or
8.3.11.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data Personal Data in connection with this Agreement.
8.4. With regard to the storage and retention of Unrounded Data relating to individuals:
8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals;
8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely;
8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
8.5. The Organisation consents to HESA Services and/or HESA appointing the Third Party Processor or any other alternative processor selected by HESA and/or HESA Services. Such Third Party Processor shall be appointed as a sub-contractor of HESA Services and/or HESA. Where the Organisation has received notice from HESA Services and/or HESA that a Third Party Processor has been appointed, HESA Services and/or HESA has delegated the operational management of Xxxxx Plus to the Third Party Processor (including but not limited to those rights and obligations expressly provided for in this Agreement). Such delegation is subject to certain material contract rights and obligations being reserved to HESA Services and/or HESA as the relevant data controller.
Appears in 1 contract
Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA they are separate Data Controllers in common of any personal data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future.
8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times:
8.2.1. Comply with the DP Legislation Act including without limitation (to the extent relevant and as set out in relevant) the DP Legislation) any obligations as to registration as a Data Controller, principles Controller and requirements for the data protection and restrictions on processing of personal data, and requirements as to notification of data breachesprinciples set out in the DP Act.
8.2.2. Fully co-operate with each other to enable the other party to comply with the DP LegislationAct.
8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall:
8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP LegislationAct;
8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliatesAffiliates, agents and contractors comply with the DP Legislation Act and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data;
8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual;
8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation;
8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and:
8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and
8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or
8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xx.
8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users:
8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses;
8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology;
8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to:
8.3.7.1. an information notice, or any other notice (including in particular any deregistration, enforcement or transfer prohibition notice) served on the Organisation by the Information Commissioner;
8.3.7.2. any formal complaint complaints from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Datadata subjects; and
8.3.7.3. any investigation of any breach or alleged breach of the DP LegislationAct;
8.3.8. The Parties agree that all uses of Where the Organisation receives a subject access request which relates or refers specifically to data within Xxxxx Plus Data are (not including any subject access request for statistical purposes all personal data held by the Organisation in accordance with article 89 of relation to the GDPR and anticipate that any legislation based on the Data Protection Xxxx which had its first reading in the House of Lords on 13 September 2017 will contain derogations from the requirements of articles 15requesting data subject), 16, 18 and 21 of the GDPR. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. HESA Services shall include within the Xxxxx Plus Operational Documentation guidance on responding to requests to exercise a right under articles 15,16,17,18 or 21 in respect of Xxxxx Plus Data and the Organisation shall have regard not respond to the subject access request itself but shall pass the subject access request to HESA Services who will respond.
8.3.9. Where the Organisation receives a subject access request which relates to all personal data held by the Organisation in relation to the requesting data subject but does not relate or refer specifically to data held within Xxxxx Plus:
8.3.9.1. the Organisation shall respond to the subject access request; and
8.3.9.2. the Organisation shall include in its response the following wording: "We subscribe to the Xxxxx Plus Operational Documentation database provided by HESA Services Ltd, which is a wholly-owned subsidiary of the Higher Education Statistics Agency Ltd (HESA) (xxx.xxxx.xx.xx). Some of our staff have access to this database, if they need the data for their work and have had appropriate training in determining how information security. Xxxxx Plus includes data relating to respond individuals who have undertaken higher education courses in the UK and staff working for higher education providers. Any data which we can access through Xxxxx Plus does not include names and identifiers but could potentially be identifiable data to a request third party who already has other information about the individual. Access to exercise a right this data is granted under articles 15,16,17,18 or 21.strict contractual terms for specific purposes relating to research, administration and equal opportunities monitoring. If you require further information about any data relating to you which may be held within Xxxxx Plus, please contact HESA Services Ltd by emailing xxxx.xxxxxxxxxx@xxxx.xx.xx "
8.3.98.3.10. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed.
8.3.108.3.11. Without prejudice to the generality of clause 8.3.98.3.10, in ensuring the security of Unrounded Data relating to individuals the Organisation shall:
8.3.10.18.3.11.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact User Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above;
8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and
8.3.10.38.3.11.2. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by:
8.3.10.3.18.3.11.2.1. completing an Information Security Questionnaire information security questionnaire in a format requested by HESA Services and submit it to HESA Services (“the Questionnaire”) prior to entering into this Agreement;
8.3.10.3.28.3.11.2.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and
8.3.10.3.38.3.11.2.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes.
8.3.118.3.12. Promptly report to HESA Services any circumstance that it becomes aware of which:
8.3.11.18.3.12.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 8.3.10 or 8.3.10 8.3.11 have not been complied with;
8.3.11.28.3.12.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation Act as a result of processing carried out in connection with this Agreement; or
8.3.11.38.3.12.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data in connection with this Agreement.
8.4. With regard to the storage and retention of Unrounded Data relating to individuals:
8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals;
8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely;
8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
Appears in 1 contract
Data Protection and Data Security. 8.1. Subject to clause 6.3, the parties acknowledge that the Organisation and HESA are separate Data Controllers in common of any personal data within Xxxxx Plus which is accessible to the Organisation or its Authorised Users. Each party acknowledges the need to manage data security and risks around use of data appropriately, both to protect the rights of individual data subjects and to avoid reputational, relationship and commercial risks to HESA and HESA Services arising from any perceived breach or inadequacy in the protection and security of data collected by HESA which could impede the ability of HESA, HESA Services and their customers to access data in the future.
8.2. Each party agrees that in connection with the provision or use of Xxxxx Plus it has a separate responsibility to, and will at all times:
8.2.1. Comply with the DP Legislation including without limitation (to the extent relevant and as set out in the DP Legislation) any obligations as to registration as a Data Controller, principles and requirements for data protection and restrictions on processing of personal data, and requirements as to notification of data breaches.
8.2.2. Fully co-operate with each other to enable the other party to comply with the DP Legislation.
8.3. In particular, without prejudice to the generality of clause 8.2, the Organisation shall:
8.3.1. Fully co-operate with HESA Services and HESA as reasonably required to ensure HESA Services’ and HESA's compliance with the DP Legislation;
8.3.2. Take all reasonable steps to ensure its Authorised Users and its other Staff Members, affiliates, agents and contractors comply with the DP Legislation and this Agreement in respect of Xxxxx Plus and Xxxxx Plus Data;
8.3.3. Not use Xxxxx Plus Data, nor permit its Authorised Users or any other person, to use Xxxxx Plus Data to identify any individual, contact any individual or take any decisions in relation to an individual;
8.3.4. Only use and only permit its Authorised Users or any other person to use, Xxxxx Plus Data relating to disability or ethnicity for purposes relating to promoting, maintaining or monitoring equality of opportunity in accordance with equalities legislation;
8.3.5. Not share or permit its Authorised Users to share Xxxxx Plus Data with anyone including Staff Members that are outside the United Kingdom unless it is necessary for a Permitted Use and:
8.3.5.1. Xxxxx Plus Data relating to individuals is rounded in accordance with the Xxxxx Plus Rounding Methodology; and
8.3.5.2. Xxxxx Plus Data which does not relate to individuals is only shared to the extent it is proportionate for that particular Permitted Use i.e. adequate, relevant and not excessive for the necessary Permitted Use; or
8.3.5.3. Specific written consent has been provided in advance of any proposed sharing by HESA Services. Requests for consent should be sent to Xxxxx.Xxxx@xxxx.xx.xx.
8.3.6. In relation to Unrounded Data relating to individuals, ensure that it, and its Authorised Users:
8.3.6.1. Only use or extract from Xxxxx Plus, and are only permitted to use or extract, such Xxxxx Plus Data where this is necessary for the Permitted Uses;
8.3.6.2. Do not and are not permitted to share such Unrounded Data relating to individuals with any person other than the Organisation's Gold Users and Lead Contacts. For the avoidance of doubt, Xxxxx Plus Data can only be reproduced, published or disclosed to any person other than the Organisation's Gold Users and Lead Contacts in a form which complies with the Xxxxx Plus Rounding Methodology;
8.3.7. In connection with any Unrounded Data relating to individuals, notify HESA Services immediately if it receives any of the following, and in any event co-operate with HESA Services and comply with any reasonable direction from HESA Services with regard to complying with or responding to:
8.3.7.1. an information notice, or any other notice served on the Organisation by the Information Commissioner;
8.3.7.2. any formal complaint from a Data Subject, including any exercise or purported exercise by a Data Subject of their rights under articles 15, 16, 17, 18 and 21 of the GDPR to access, rectification, erasure, restriction of processing or objection to processing of Xxxxx Plus Data; and
8.3.7.3. any investigation of any breach or alleged breach of the DP Legislation;
8.3.8. The Parties agree that all uses of Xxxxx Plus Data are for statistical purposes in accordance with article 89 of the GDPR and anticipate that any legislation based on the Data Protection Xxxx which had its first reading in the House of Lords on 13 September 2017 will contain derogations from the requirements of articles 15, 16, 18 and 21 of the GDPR. The Parties recognise that article 17 of the GDPR already includes an exemption for processing for statistical purposes. HESA Services shall include within the Xxxxx Plus Operational Documentation guidance on responding to requests to exercise a right under articles 15,16,17,18 or 21 in respect of Xxxxx Plus Data and the Organisation shall have regard to the Xxxxx Plus Operational Documentation in determining how to respond to a request to exercise a right under articles 15,16,17,18 or 21.
8.3.9. Ensure that Unrounded Data relating to individuals is used only in accordance with clauses 8.3.2 to 8.3.6, is held in strict confidence and securely and that appropriate technical and organisational information security and processing procedures are established and maintained to ensure that Unrounded Data relating to individuals processed under this Agreement are sufficiently protected against any unlawful or unauthorised processing, including in the disposal or destruction of equipment on which Unrounded Data relating to individuals is stored or accessed.
8.3.10. Without prejudice to the generality of clause 8.3.98.3.10, in ensuring the security of Unrounded Data relating to individuals the Organisation shall:
8.3.10.1. restrict access to Gold Users and Lead Contact Users who satisfy a Lead Contact that they require access to such data for Permitted Uses and who agree to the terms of use in the Gold User Agreement or the Lead Contact Agreement (as appropriate) and undertake relevant training provided in accordance with clause 4.5 above;
8.3.10.2. take all reasonable steps to facilitate and assist compliance by Gold Users and Lead Contact Users with their obligations with regard to secure and appropriate use of Xxxxx Plus Data, data security and deletion of data, in particular the obligations set out in clauses 4.1.1, 4.7 and 5.3 of the Gold User Agreement and clauses 5.1.1, 5.7 and 6.3 of the Lead Contact Use Agreement; and
8.3.10.3. provide prompt and accurate information to HESA Services about its information security arrangements and processes, including by:
8.3.10.3.1. completing an Information Security Questionnaire prior to entering into this Agreement;
8.3.10.3.2. during the life of this Agreement, promptly notifying HESA Services of any changes to the matters covered by the Information Security Questionnaire which materially alter the nature or scope of the systems and arrangements for data security which the Organisation has in place in respect of Unrounded Data relating to individuals; and
8.3.10.3.3. responding to such questions as HESA Services may ask from time to time with regard to its information security arrangements and processes.
8.3.11. Promptly report to HESA Services any circumstance that it becomes aware of which:
8.3.11.1. mean or would reasonably be regarded as meaning that any of clauses 8.2.1, 8.3.1 to 8.3.7, 8.3.9 or 8.3.10 have not been complied with;
8.3.11.2. cause or would reasonably be regarded as causing any party to breach the DP Legislation as a result of processing carried out in connection with this Agreement; or
8.3.11.3. mean or would reasonably be regarded as meaning that there has been unauthorised processing of personal data in connection with this Agreement.
8.4. With regard to the storage and retention of Unrounded Data relating to individuals:
8.4.1. the parties acknowledge that the purposes for which the Organisation and its Authorised Users process Xxxxx Plus Data include purposes within section 33 of the Data Protection Xxx 0000 and Article 89 of the GDPR, including the carrying out of statistical analysis to identify trends and developments over long time periods, and purposes relating to the public tasks of the Organisation and the wider public interest. In addition, the terms of this Agreement and the Authorised User Agreements permit repeated access to Xxxxx Plus Data for the duration of those Agreements. Therefore, it may be lawful and appropriate for the Organisation's Authorised Users to retain Xxxxx Plus Data constituting Unrounded Data relating to individuals over long periods of time Accordingly no fixed retention period or destruction date is specified under this Agreement in respect of Unrounded Data relating to individuals;
8.4.2. the Organisation acknowledges that Unrounded Data relating to individuals should only be accessed and retained (whether electronically or in hard copy form) to the extent necessary and proportionate for the Permitted Uses pursued by an Authorised User, and must be held securely;
8.4.3. without prejudice to the obligations stated in this clause 8, the Organisation shall make appropriate arrangements for monitoring the steps taken by Authorised Users as required by the Authorised User Agreements to review the need to retain Unrounded Data relating to individuals; to destroy or delete any such Unrounded Data which is no longer needed for the Permitted Uses; and to ensure that any such Unrounded Data which is extracted from Xxxxx Plus and held either electronically or in hard copy form is held securely subject to appropriate technical and organisational measures for data security.
Appears in 1 contract
