Common use of Data Protection and Security Clause in Contracts

Data Protection and Security. The Parties agree that, as between them, all UNICEF Data, together with all rights (including intellectual property and proprietary rights), title and interest to such UNICEF Data, shall be the exclusive property of UNICEF, and the Consultant has a non-exclusive license to access and use the UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Consultant shall have no other rights, whether express or implied, in or to any UNICEF Data or its content. The Consultant confirms that it has a data protection policy in place that meets all applicable data protection standards and legal requirements and that it shall apply such policy in the collection, storage, use, processing, retention and destruction of UNICEF Data. The Consultant shall comply with any guidance or conditions on access and disclosure notified by UNICEF to the Consultant in respect of UNICEF Data. The Consultant shall ensure the logical segregation of UNICEF Data from other information to the fullest extent possible. The Consultant shall put in place policies, safeguards and controls (such as administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other protective measures) that are necessary and sufficient to meet the Consultant’s confidentiality obligations in this Contract as they apply to UNICEF Data. At UNICEF’s request, the Consultant shall provide UNICEF with copies of the applicable policies and a description of the safeguards and controls that the Consultant uses to fulfil its obligations under this Contract. UNICEF may assess the effectiveness of these safeguards, controls and protective measures and, at UNICEF’s request, the Consultant shall provide its full cooperation with any such assessment at no additional cost or expense to UNICEF. The Consultant shall not, and shall ensure that the Personnel and Affiliates shall not, transfer, copy, remove or store UNICEF Data from a UNICEF location, network or system without the prior written approval of an authorized official of UNICEF. Except as otherwise expressly stated in the Contract or with UNICEF’s express prior written consent, the Consultant shall not install any application or other software on any UNICEF device, network or system. The Consultant represents and warrants to UNICEF that the Services and Deliverables provided under the Contract shall not contain any Disabling Code, and that UNICEF shall not otherwise receive from the Consultant any Disabling Code in the performance of the Contract. Without prejudice to UNICEF’s other rights and remedies, if a Disabling Code is identified, the Consultant, at its sole cost and expense, shall take all steps necessary to: (a) restore and/or reconstruct any and all UNICEF Data lost by UNICEF, the Beneficiary and/or End Users as a result of Disabling Code; (b) furnish to UNICEF a corrected version of the Services without the presence of Disabling Codes; and (c) as needed, re-perform the Services and accelerate the Services such that no delay is caused by the Disabling Code, at the Consultant’s cost. In the event of any Security Incident, the Consultant shall, as soon as possible following the Consultant’s discovery of such Security Incident and at its sole cost and expense: (a) notify UNICEF of such Security Incident and of the Consultant’s proposed remedial actions; (b) implement any and all necessary damage mitigation and remedial actions; and (c) as relevant, restore UNICEF’s and, as directed by UNICEF, the Beneficiary’s and/or End Users’ access to the Services. The Consultant shall keep UNICEF reasonably informed of the progress of the Consultant’s implementation of such damage mitigation and remedial actions. The Consultant, at its sole cost and expense, shall cooperate fully with UNICEF’s investigation of, remediation of, and/or response to any Security Incident. If the Consultant fails to resolve, to UNICEF’s reasonable satisfaction, any such Security Incident, UNICEF can terminate the Contract with immediate effect. The Consultant shall impose the same requirements relating to data protection and security as are imposed upon the Consultant itself by this clause 13 of the Contract, on the Personnel and Affiliates and shall remain responsible for compliance with such requirements by the Personnel and/or Affiliates.

Data Protection and Security. The Parties agree that, as between them, all UNICEF Data, together with all rights (including intellectual property and proprietary rights), title and interest to such UNICEF Data, shall be the exclusive property of UNICEF, and the Consultant Contractor has a non-exclusive license to access and use the UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Consultant Contractor shall have no other rights, whether express or implied, in or to any UNICEF Data or its content. The Consultant Contractor confirms that it has a data protection policy in place that meets all applicable data protection standards and legal requirements and that it shall apply such policy in the collection, storage, use, processing, retention and destruction of UNICEF Data. The Consultant Contractor shall comply with any guidance or conditions on access and disclosure notified by UNICEF to the Consultant Contractor in respect of UNICEF Data. The Consultant Contractor shall ensure the logical segregation of UNICEF Data from other information to the fullest extent possible. The Consultant Contractor shall put in place policies, safeguards and controls (such as administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other protective measures) that are necessary and sufficient to meet the ConsultantContractor’s confidentiality obligations in under this Contract as they apply to in respect of UNICEF Data. At UNICEF’s request, the Consultant Contractor shall provide UNICEF with copies of the applicable policies and a description of the safeguards and controls that the Consultant uses to fulfil its obligations under this Contractcontrols. UNICEF may assess the effectiveness of these safeguards, controls and protective measures and, at UNICEF’s request, the Consultant Contractor shall provide its full cooperation with any such assessment at no additional cost or expense to UNICEF. The Consultant Contractor shall not, and shall ensure that the Personnel and Affiliates shall not, transfer, copy, remove or store UNICEF Data from a UNICEF location, network or system without the prior written approval of an authorized official of UNICEF. Except as otherwise expressly stated in the Contract or with UNICEF’s express prior written consent, the Consultant Contractor shall not install any application or other software on any UNICEF device, network or system. The Consultant Contractor represents and warrants to UNICEF that the Services Works and Deliverables provided under the Contract shall not contain any Disabling Code, and that UNICEF shall not otherwise receive from the Consultant Contractor any Disabling Code in the performance of the Contract. Without prejudice to UNICEF’s other rights and remedies, if a Disabling Code is identified, the ConsultantContractor, at its sole cost and expense, shall take all steps necessary to: (a) restore and/or reconstruct any and all UNICEF Data lost by UNICEF, the Beneficiary and/or End Users as a result of Disabling Code; (b) furnish to UNICEF a corrected version of the Services Works without the presence of Disabling Codes; and (c) as needed, re-perform remedy any Defects in the Services Works caused by the Disabling Code and accelerate the Services Works such that no delay is caused by the Disabling Code, at the ConsultantContractor’s cost. In the event of any Security Incident, the Consultant Contractor shall, as soon as possible following the ConsultantContractor’s discovery of such Security Incident and at its sole cost and expense: (a) notify UNICEF of such Security Incident and of the ConsultantContractor’s proposed remedial actions; (b) implement any and all necessary damage mitigation and remedial actions; and (c) as relevant, restore UNICEF’s and, as directed by UNICEF, the Beneficiary’s and/or End Users’ access to the ServicesWorks. The Consultant Contractor shall keep UNICEF reasonably informed of the progress of the ConsultantContractor’s implementation of such damage mitigation and remedial actions. The ConsultantContractor, at its sole cost and expense, shall cooperate fully with UNICEF’s investigation of, remediation of, and/or response to any Security Incident. If the Consultant Contractor fails to resolve, to UNICEF’s reasonable satisfaction, any such Security Incident, UNICEF can terminate the Contract with immediate effect. The Consultant Contractor shall impose the same requirements relating to data protection and security as are imposed upon the Consultant Contractor itself by this clause 13 14 of the Contract, on the Personnel and Affiliates and shall remain responsible for compliance with such requirements by the Personnel and/or Affiliates.

Data Protection and Security. The Parties agree that, as between them, all UNICEF Data, together with all rights (including intellectual property and proprietary rights), title and interest to such UNICEF Data, shall be the exclusive property of UNICEF, and the Consultant Contractor has a non-exclusive license to access and use the UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Consultant Contractor shall have no other rights, whether express or implied, in or to any UNICEF Data or its content. The Consultant Contractor confirms that it has a data protection policy in place that meets all applicable data protection standards and legal requirements and that it shall apply such policy in the collection, storage, use, processing, retention and destruction of UNICEF Data. The Consultant Contractor shall comply with any guidance or conditions on access and disclosure notified by UNICEF to the Consultant Contractor in respect of UNICEF Data. The Consultant Contractor shall ensure the logical segregation of UNICEF Data from other information to the fullest extent possible. The Consultant Contractor shall put in place policies, safeguards and controls (such as administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other protective measures) that are necessary and sufficient to meet the ConsultantContractor’s confidentiality obligations in under this Contract as they apply to in respect of UNICEF Data. At UNICEF’s request, the Consultant Contractor shall provide UNICEF with copies of the applicable policies and a description of the safeguards and controls that the Consultant uses to fulfil its obligations under this Contractcontrols. UNICEF may assess the effectiveness of these safeguards, controls and protective measures and, at UNICEF’s request, the Consultant Contractor shall provide its full cooperation with any such assessment at no additional cost or expense to UNICEF. The Consultant Contractor shall not, and shall ensure that the Personnel and Affiliates shall not, transfer, copy, remove or store UNICEF Data from a UNICEF location, network or system without the prior written approval of an authorized official of UNICEF. Except as otherwise expressly stated in the Contract or with UNICEF’s express prior written consent, the Consultant Contractor shall not install any application or other software on any UNICEF device, network or system. The Consultant Contractor represents and warrants to UNICEF that the Services Works and Deliverables provided under the Contract shall not contain any Disabling Code, and that UNICEF shall not otherwise receive from the Consultant Contractor any Disabling Code in the performance of the Contract. Without prejudice to UNICEF’s other rights and remedies, if a Disabling Code is identified, the ConsultantContractor, at its sole cost and expense, shall take all steps necessary to: : (a) restore and/or reconstruct any and all UNICEF Data lost by UNICEF, the Beneficiary and/or End Users as a result of Disabling Code; (b) furnish to UNICEF a corrected version of the Services Works without the presence of Disabling Codes; and (c) as needed, re-perform remedy any Defects in the Services Works caused by the Disabling Code and accelerate the Services Works such that no delay is caused by the Disabling Code, at the ConsultantContractor’s cost. In the event of any Security Incident, the Consultant Contractor shall, as soon as possible following the ConsultantContractor’s discovery of such Security Incident and at its sole cost and expense: (a) notify UNICEF of such Security Incident and of the ConsultantContractor’s proposed remedial actions; (b) implement any and all necessary damage mitigation and remedial actions; and (c) as relevant, restore UNICEF’s and, as directed by UNICEF, the Beneficiary’s and/or End Users’ access to the ServicesWorks. The Consultant Contractor shall keep UNICEF reasonably informed of the progress of the ConsultantContractor’s implementation of such damage mitigation and remedial actions. The ConsultantContractor, at its sole cost and expense, shall cooperate fully with UNICEF’s investigation of, remediation of, and/or response to any Security Incident. If the Consultant Contractor fails to resolve, to UNICEF’s reasonable satisfaction, any such Security Incident, UNICEF can terminate the Contract with immediate effect. The Consultant Contractor shall impose the same requirements relating to data protection and security as are imposed upon the Consultant Contractor itself by this clause 13 14 of the Contract, on the Personnel and Affiliates and shall remain responsible for compliance with such requirements by the Personnel and/or Affiliates.

Data Protection and Security. The Parties agree that, as between them, all UNICEF Data, together with all rights (including intellectual property and proprietary rights), title and interest to such UNICEF Data, shall be the exclusive property of UNICEF, and the Consultant Contractor has a non-exclusive license to access and use the UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Consultant Contractor shall have no other rights, whether express or implied, in or to any UNICEF Data or its content. The Consultant Contractor confirms that it has a data protection policy in place that meets all applicable data protection standards and legal requirements and that it shall apply such policy in the collection, storage, use, processing, retention and destruction of UNICEF Data. The Consultant Contractor shall comply with any guidance or conditions on access and disclosure notified by UNICEF to the Consultant Contractor in respect of UNICEF Data. The Consultant Contractor shall ensure the logical segregation of UNICEF Data from other information to the fullest extent possible. The Consultant Contractor shall put in place policies, safeguards and controls (such as administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other protective measures) that are necessary and sufficient to meet the ConsultantContractor’s confidentiality obligations in under this Contract as they apply to in respect of UNICEF Data. At UNICEF’s request, the Consultant Contractor shall provide UNICEF with copies of the applicable policies and a description of the safeguards and controls that the Consultant uses to fulfil its obligations under this Contractcontrols. UNICEF may assess the effectiveness of these safeguards, controls and protective measures and, at UNICEF’s request, the Consultant Contractor shall provide its full cooperation with any such assessment at no additional cost or expense to UNICEF. The Consultant Contractor shall not, and shall ensure that the Personnel and Affiliates shall not, transfer, copy, remove or store UNICEF Data from a UNICEF location, network or system without the prior written approval of an authorized official of UNICEF. Except as otherwise expressly stated in the Contract or with UNICEF’s express prior written consent, the Consultant Contractor shall not install any application or other software on any UNICEF device, network or system. The Consultant Contractor represents and warrants to UNICEF that the Services Works and Deliverables provided under the Contract shall not contain any Disabling Code, and that UNICEF shall not otherwise receive from the Consultant Contractor any Disabling Code in the performance of the Contract. Without prejudice to UNICEF’s other rights and remedies, if a Disabling Code is identified, the ConsultantContractor, at its sole cost and expense, shall take all steps necessary to: (a) restore and/or reconstruct any and all UNICEF Data lost by UNICEF, the Beneficiary and/or End Users as a result of Disabling Code; (b) furnish to UNICEF a corrected version of the Services Works without the presence of Disabling Codes; and (c) as needed, re-perform remedy any Defects in the Services Works caused by the Disabling Code and accelerate the Services Works such that no delay is caused by the Disabling Code, at the ConsultantContractor’s cost. In the event of any Security Incident, the Consultant Contractor shall, as soon as possible following the ConsultantContractor’s discovery of such Security Incident and at its sole cost and expense: (a) notify UNICEF of such Security Incident and of the ConsultantContractor’s proposed remedial actions; (b) implement any and all necessary damage mitigation and remedial actions; and (c) as relevant, restore UNICEF’s and, as directed by UNICEF, the Beneficiary’s and/or End Users’ access to the ServicesWorks. The Consultant Contractor shall keep UNICEF reasonably informed of the progress of the ConsultantContractor’s implementation of such damage mitigation and remedial actions. The ConsultantContractor, at its sole cost and expense, shall cooperate fully with UNICEF’s investigation of, remediation of, and/or response to any Security Incident. If the Consultant Contractor fails to resolve, to UNICEF’s reasonable satisfaction, any such Security Incident, UNICEF can terminate the Contract with immediate effect. The Consultant Contractor shall impose the same requirements relating to data protection and security as are imposed upon the Consultant Contractor itself by this clause 13 16 of the Contract, on the Personnel and Affiliates and shall remain responsible for compliance with such requirements by the Personnel and/or Affiliates.

Data Protection and Security. The Parties agree that, as between them, all UNICEF Data, together with all rights (including intellectual property and proprietary rights), title and interest to such UNICEF Data, shall be the exclusive property of UNICEF, and the Consultant Contractor has a non-exclusive license to access and use the UNICEF Data as provided in the Contract solely for the purpose of performing its obligations under the Contract. Except for the foregoing license, the Consultant Contractor shall have no other rights, whether express or implied, in or to any UNICEF Data or its content. The Consultant Contractor confirms that it has a data protection policy in place that meets all applicable data protection standards and legal requirements and that it shall apply such policy in the collection, storage, use, processing, retention and destruction of UNICEF Data. The Consultant Contractor shall comply with any guidance or conditions on access and disclosure notified by UNICEF to the Consultant Contractor in respect of UNICEF Data. The Consultant Contractor shall ensure the logical segregation of UNICEF Data from other information to the fullest extent possible. The Consultant Contractor shall put in place policies, safeguards and controls (such as administrative, technical, physical, procedural and security infrastructures, facilities, tools, technologies, practices and other protective measures) that are necessary and sufficient to meet the ConsultantContractor’s confidentiality obligations in under this Contract as they apply to in respect of UNICEF Data. At UNICEF’s request, the Consultant Contractor shall provide UNICEF with copies of the applicable policies and a description of the safeguards and controls that the Consultant uses to fulfil its obligations under this Contractcontrols. UNICEF may assess the effectiveness of these safeguards, controls and protective measures and, at UNICEF’s request, the Consultant Contractor shall provide its full cooperation with any such assessment at no additional cost or expense to UNICEF. The Consultant Contractor shall not, and shall ensure that the Personnel and Affiliates shall not, transfer, copy, remove or store UNICEF Data from a UNICEF location, network or system without the prior written approval of an authorized official of UNICEF. Except as otherwise expressly stated in the Contract or with UNICEF’s express prior written consent, the Consultant Contractor shall not install any application or other software on any UNICEF device, network or system. The Consultant Contractor represents and warrants to UNICEF that the Services Works and Deliverables provided under the Contract shall not contain any Disabling Code, and that UNICEF shall not otherwise receive from the Consultant Contractor any Disabling Code in the performance of the Contract. Without prejudice to UNICEF’s other rights and remedies, if a Disabling Code is identified, the ConsultantContractor, at its sole cost and expense, shall take all steps necessary to: : (a) restore and/or reconstruct any and all UNICEF Data lost by UNICEF, the Beneficiary and/or End Users as a result of Disabling Code; (b) furnish to UNICEF a corrected version of the Services Works without the presence of Disabling Codes; and (c) as needed, re-perform remedy any Defects in the Services Works caused by the Disabling Code and accelerate the Services Works such that no delay is caused by the Disabling Code, at the ConsultantContractor’s cost. In the event of any Security Incident, the Consultant Contractor shall, as soon as possible following the ConsultantContractor’s discovery of such Security Incident and at its sole cost and expense: (a) notify UNICEF of such Security Incident and of the ConsultantContractor’s proposed remedial actions; (b) implement any and all necessary damage mitigation and remedial actions; and (c) as relevant, restore UNICEF’s and, as directed by UNICEF, the Beneficiary’s and/or End Users’ access to the ServicesWorks. The Consultant Contractor shall keep UNICEF reasonably informed of the progress of the ConsultantContractor’s implementation of such damage mitigation and remedial actions. The ConsultantContractor, at its sole cost and expense, shall cooperate fully with UNICEF’s investigation of, remediation of, and/or response to any Security Incident. If the Consultant Contractor fails to resolve, to UNICEF’s reasonable satisfaction, any such Security Incident, UNICEF can terminate the Contract with immediate effect. The Consultant Contractor shall impose the same requirements relating to data protection and security as are imposed upon the Consultant Contractor itself by this clause 13 16 of the Contract, on the Personnel and Affiliates and shall remain responsible for compliance with such requirements by the Personnel and/or Affiliates.