DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS Sample Clauses

DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 5.1 Company Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in ANNEX 3. 5.2 Upon your reasonable request, we will make available all information reasonably necessary to demonstrate compliance with this DPA.
Sample 1Sample 2
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 1. HotelFlex Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, HotelFlex shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in ANNEX 2.
Sample 1Sample 2
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 4.1 Security Obligations. cPanel will implement and maintain the technical and organizational measures set out in Schedule 3. You acknowledge and agree that these measures ensure a level of security that is appropriate to the risk. 4.2 Upon your reasonable request, cPanel will make available all information reasonably necessary to demonstrate compliance with this DPA.
Sample 1
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 6.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Veriff shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including any measure set out in Terms and (as appropriate) any other measures listed in Article 32(1) of the GDPR. Veriff is entitled to unilaterally change and update such measures provided that the measures, at all times, comply with Article 32(1) of the GDPR. 6.2. The Client may, upon 30 days’ prior notice and at Veriff’s regular business hours, audit (either by itself or using independent third party auditors) Veriff's compliance with the security measures set out in this DPA, including by conducting audits of Veriff's data processing facilities. The Client shall submit, together with the aforementioned notice, an auditing plan, detailing the compliance elements and data processing facilities (in terms of functions) which are subject to the audit. Veriff shall assist with, and contribute to such audits conducted in accordance with this clause 6.2, provided that such audits are not carried out more than once a year. The Parties shall bear their own costs related to the audit. In case of any additional assistance, drafting of compliance documents, assisting with the requests or making available information reasonably necessary to demonstrate compliance with this DPA or with the Standard Contractual Clauses, that goes beyond auditing set forth in clause 6.2, Veriff shall have the right to reimbursement of costs and work as notified to the Client prior to providing such assistance. 6.3. Veriff may, upon 30 days’ prior notice and at the Client’s regular business hours, audit (either by itself or using independent third party auditors) Client's compliance with this DPA, including by conducting audits of Client's data processing facilities. Veriff shall submit, together with the notice, an auditing plan, detailing the compliance elements and data processing facilities (in terms of functions) which are subject to the audit. Client shall assist with, and contribute to any audits conducted in accordance with this clause 6.3, provided that such audits are not carried out more than once a year. The Parties shall bear their own costs related to the audit. 6.4. Where required under Article 28(3)(h) of the G...
Sample 1
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 5.1. dbt Labs Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, dbt Labs shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in ANNEX 3. 5.2. Upon request by the Subscriber, dbt Labs shall make available all information reasonably necessary to demonstrate compliance with this DPA.
Sample 1
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS. 5.1 Artesian Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in Annex 2.
Sample 1
DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS 
Sample 1Sample 2Sample 3

Related to DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS

  • Background and Security Investigations 7.5.1 Each of Contractor’s staff performing services under this Contract, who is in a designated sensitive position, as determined by County in County's sole discretion, shall undergo and pass a background investigation to the satisfaction of County as a condition of beginning and continuing to perform services under this Contract. Such background investigation must be obtained through fingerprints submitted to the California Department of Justice to include State, local, and federal-level review, which may include, but shall not be limited to, criminal conviction information. The fees associated with the background investigation shall be at the expense of the Contractor, regardless of whether the member of Contractor’s staff passes or fails the background investigation. If a member of Contractor’s staff does not pass the background investigation, County may request that the member of Contractor’s staff be removed immediately from performing services under the Contract. Contractor shall comply with County’s request at any time during the term of the Contract. County will not provide to Contractor or to Contractor’s staff any information obtained through the County’s background investigation. 7.5.2 County, in its sole discretion, may immediately deny or terminate facility access to any member of Contractor’s staff that does not pass such investigation to the satisfaction of the County or whose background or conduct is incompatible with County facility access. 7.5.3 Disqualification of any member of Contractor’s staff pursuant to this Paragraph 7.5 shall not relieve Contractor of its obligation to complete all work in accordance with the terms and conditions of this Contract.

  • COMPLIANCE WITH BREACH NOTIFICATION AND DATA SECURITY LAWS Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law § 899-aa and State Technology Law § 208) and commencing March 21, 2020 shall also comply with General Business Law § 899-bb.

  • Safety and Security Procedures Contractor shall maintain and enforce, at the Contractor Work Locations, industry-standard safety and physical security policies and procedures. While at each JBE Work Location, Contractor shall comply with the safety and security policies and procedures in effect at such JBE Work Location.

  • Data Security Requirements Without limiting Contractor’s obligation of confidentiality as further described in this Contract, Contractor must establish, maintain, and enforce a data privacy program and an information and cyber security program, including safety, physical, and technical security and resiliency policies and procedures, that comply with the requirements set forth in this Contract and, to the extent such programs are consistent with and not less protective than the requirements set forth in this Contract and are at least equal to applicable best industry practices and standards (NIST 800-53).

  • New Hampshire Specific Data Security Requirements The Provider agrees to the following privacy and security standards from “the Minimum Standards for Privacy and Security of Student and Employee Data” from the New Hampshire Department of Education. Specifically, the Provider agrees to: (1) Limit system access to the types of transactions and functions that authorized users, such as students, parents, and LEA are permitted to execute; (2) Limit unsuccessful logon attempts; (3) Employ cryptographic mechanisms to protect the confidentiality of remote access sessions; (4) Authorize wireless access prior to allowing such connections; (5) Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity; (6) Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions; (7) Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; (8) Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services; (9) Enforce a minimum password complexity and change of characters when new passwords are created; (10) Perform maintenance on organizational systems; (11) Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance; (12) Ensure equipment removed for off-site maintenance is sanitized of any Student Data in accordance with NIST SP 800-88 Revision 1; (13) Protect (i.e., physically control and securely store) system media containing Student Data, both paper and digital; (14) Sanitize or destroy system media containing Student Data in accordance with NIST SP 800-88 Revision 1 before disposal or release for reuse; (15) Control access to media containing Student Data and maintain accountability for media during transport outside of controlled areas; (16) Periodically assess the security controls in organizational systems to determine if the controls are effective in their application and develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems; (17) Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems; (18) Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception); (19) Protect the confidentiality of Student Data at rest; (20) Identify, report, and correct system flaws in a timely manner; (21) Provide protection from malicious code (i.e. Antivirus and Antimalware) at designated locations within organizational systems; (22) Monitor system security alerts and advisories and take action in response; and (23) Update malicious code protection mechanisms when new releases are available.

  • Data Security and Privacy (a) Each Group Member is, and at all times, has been, in compliance in all material respects with (i) all applicable Data Protection Laws, including, to the extent applicable, but not limited to the GDPR and those relating to cross-border transfers; (ii) all applicable contractual obligations of each Loan Party and its Subsidiaries concerning data privacy and security relating to Personal Data in the possession or control of any Group Member or maintained by third parties on behalf of such Group Member and having access to such information under contracts (or portions thereof) to which a Group Member is a party; and (iii) all applicable data transfer agreements and data processing agreements, including the EU standard contractual clauses, to which a Group Member is a party (collectively, “Privacy Agreements”): (b) Each Group Member is, and has been, in compliance in all material respects with all applicable prior and current written internal and public-facing privacy policies and notices of the Group Members regarding the collection, retention, use, processing, disclosure and distribution of Personal Data by the Group Members or their respective agents (collectively, the “Privacy Policies”), and the Privacy Policies have been maintained to be consistent in all material respects with the actual practices of each Group Member. The Privacy Policies contemplate the Group Members’ current uses of the Personal Data, and to the extent required under applicable Data Protection Laws, each Group Member has sought and obtained the appropriate consent from the applicable data subject for such uses. The Privacy Policies have made all material disclosures to users, customers, employees, or other individuals required by Data Protection Laws. (c) Each Group Member has implemented and maintains a commercially reasonable security program (“Security Program”) that (i) complies in all material respects with all applicable Data Protection Laws, applicable Privacy Policies, and applicable Privacy Agreements, and (ii) includes commercially reasonable administrative, technical, organization, and physical security procedures and measures designed to preserve the security and integrity of all Personal Data and any other sensitive or confidential information or data related to each Group Member (collectively, “Company Sensitive Information”) in such Group Member’s possession or control and to protect such Company Sensitive Information against unauthorized or unlawful processing, access, acquisition, use, theft, interruption, modification, disclosure, loss, destruction or damage. (d) Except as disclosed on Schedule 4.23(d), there has been (i) no actual, suspected or alleged (in writing) incidents of unauthorized access, use, intrusion, disclosure or breach of the security of any information technology systems owned or controlled by a Group Member or any of their contractors and used by such contractors on behalf of a Group Member, and (ii) no actual, suspected or alleged (in writing) incidents of unauthorized acquisition, destruction, damage, disclosure, loss, corruption, alteration, or use of any Company Sensitive Information, in each case that could reasonably be expected to cause a Material Adverse Effect. (e) Each Group Member has a valid and legal right (whether contractually, by applicable law or otherwise) to access or use all Personal Data that is accessed and used by or on behalf of a Group Member in connection with the sale, use and/or operation of their products, services and businesses. (f) Except as would not reasonably be expected to have a Material Adverse Effect, there is no pending or to the knowledge of any Loan Party, threatened in writing, complaints, claims, demands, inquiries, proceedings, or other notices, including any notices of any investigation or other legal proceedings, regarding a Group Member, initiated by (i) any Governmental Authority, including the United States Federal Trade Commission, a state attorney general, data protection authority or similar state official, or a supervisory authority; (ii) any counterparty to, or subject of, a Privacy Agreement; or (iii) any self-regulatory authority or entity, alleging that any activity of a Group Member: (1) is in violation of any applicable Data Protection Laws, (2) is in violation of any Privacy Agreements, (3) is in violation of any Privacy Policies or (4) is otherwise in violation of any person’s privacy, personal or confidentiality rights.

  • Acknowledgement and Consent to Bail-In of EEAAffected Financial Institutions Notwithstanding anything to the contrary in any Loan Document or in any other agreement, arrangement or understanding among any such parties, each party hereto acknowledges that any liability of any EEAAffected Financial Institution arising under any Loan Document, to the extent such liability is unsecured, may be subject to the write-down and conversion powers of an EEAthe applicable Resolution Authority and agrees and consents to, and acknowledges and agrees to be bound by: (a) the application of any Write-Down and Conversion Powers by an EEAthe applicable Resolution Authority to any such liabilities arising hereunder which may be payable to it by any party hereto that is an EEAAffected Financial Institution; and (b) the effects of any Bail-in Action on any such liability, including, if applicable: (i) a reduction in full or in part or cancellation of any such liability; (ii) a conversion of all, or a portion of, such liability into shares or other instruments of ownership in such EEAAffected Financial Institution, its parent undertaking, or a bridge institution that may be issued to it or otherwise conferred on it, and that such shares or other instruments of ownership will be accepted by it in lieu of any rights with respect to any such liability under this Agreement or any other Loan Document; or (iii) the variation of the terms of such liability in connection with the exercise of the write-down and conversion powers of any EEAthe applicable Resolution Authority.

  • Data Security The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security. The provider shall implement an adequate Cybersecurity Framework based on one of the nationally recognized standards set forth set forth in Exhibit “F”. Exclusions, variations, or exemptions to the identified Cybersecurity Framework must be detailed in an attachment to Exhibit “H”. Additionally, Provider may choose to further detail its security programs and measures that augment or are in addition to the Cybersecurity Framework in Exhibit “F”. Provider shall provide, in the Standard Schedule to the DPA, contact information of an employee who XXX may contact if there are any data security concerns or questions.

  • NOTIFICATIONS AND SUBMISSION OF REPORTS Unless otherwise stated in writing after the Effective Date, all notifications and reports required under this IA shall be submitted to the following entities: Administrative and Civil Remedies Branch Office of Counsel to the Inspector General Office of Inspector General U.S. Department of Health and Human Services Xxxxx Building, Room 5527 000 Xxxxxxxxxxxx Xxxxxx, XX Xxxxxxxxxx, XX 00000 Telephone: (000) 000-0000 Facsimile: (000) 000-0000 LFAC: Xxxxxxx X. Xxxxx, DPM 0000 Xxxxxxxxxxx Xx. X-000 Xxxxxxxxx, XX 00000 Telephone: (000) 000-0000 Email: xx.xxxxx@xxxxx.xxx Unless otherwise specified, all notifications and reports required by this IA may be made by electronic mail, overnight mail, hand delivery, or other means, provided that there is proof that such notification was received. Upon request by OIG, LFAC may be required to provide OIG with an additional copy of each notification or report required by this IA in OIG’s requested format (electronic or paper).

  • Data Security and Unauthorized Data Release The Requester and Approved Users, including the Requester’s IT Director, acknowledge NIH’s expectation that they have reviewed and agree to manage the requested controlled-access dataset(s) and any Data Derivatives of controlled-access datasets according to NIH’s expectations set forth in the current NIH Security Best Practices for Controlled-Access Data Subject to the GDS Policy and the Requester’s IT security requirements and policies. The Requester, including the Requester’s IT Director, agree that the Requester’s IT security requirements and policies are sufficient to protect the confidentiality and integrity of the NIH controlled-access data entrusted to the Requester. If approved by NIH to use cloud computing for the proposed research project, as outlined in the Research and Cloud Computing Use Statements of the Data Access Request, the Requester acknowledges that the IT Director has reviewed and understands the cloud computing guidelines in the NIH Security Best Practices for Controlled-Access Data Subject to the NIH GDS Policy. The Requester and PI agree to notify the appropriate DAC(s) of any unauthorized data sharing, breaches of data security, or inadvertent data releases that may compromise data confidentiality within 24 hours of when the incident is identified. As permitted by law, notifications should include any known information regarding the incident and a general description of the activities or process in place to define and remediate the situation fully. Within 3 business days of the DAC notification, the Requester agrees to submit to the DAC(s) a detailed written report including the date and nature of the event, actions taken or to be taken to remediate the issue(s), and plans or processes developed to prevent further problems, including specific information on timelines anticipated for action. The Requester agrees to provide documentation verifying that the remediation plans have been implemented. Repeated violations or unresponsiveness to NIH requests may result in further compliance measures affecting the Requester. NIH, or another entity designated by NIH may, as permitted by law, also investigate any data security incident or policy violation. Approved Users and their associates agree to support such investigations and provide information, within the limits of applicable local, state, tribal, and federal laws and regulations. In addition, Requester and Approved Users agree to work with the NIH to assure that plans and procedures that are developed to address identified problems are mutually acceptable and consistent with applicable law.