Common use of Independent Controllers of Personal Data Clause in Contracts

Independent Controllers of Personal Data. The Parties acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of National Highways (excluding the Supplier Personnel) engaged in the performance of National Highways’ duties under the Contract) for which National Highways is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that National Highways cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by National Highways] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: employment processing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include: name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain were geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisation:

Independent Controllers of Personal Data. The Parties Party acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of National Highways Buyer (excluding the Supplier Personnel) engaged in the performance of National Highways’ the Buyer’s duties under the ContractBuyer Agreement) for which National Highways Buyer is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that National Highways the Buyer cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by National Highwaysthe Buyer] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: include employment processingProcessing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include: include name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain were geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisation:

Independent Controllers of Personal Data. The Parties acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of National Highways (excluding the Supplier Personnel) engaged in the performance of National Highways’ duties under the Contract) for which National Highways is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that National Highways cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by National Highways] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: employment processing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include: name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain Explain were geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisationorganisation will need to deliver against the following SEDPS Social Value Objectives:

Independent Controllers of Personal Data. The Parties Party acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation Error! Reference source not found. in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of National Highways Buyer (excluding the Supplier Personnel) engaged in the performance of National Highways’ the Buyer’s duties under the ContractBuyer Agreement) for which National Highways Buyer is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that National Highways the Buyer cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by National Highwaysthe Buyer] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include: include employment processingProcessing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include: include name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain were where geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. e.g., adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisation:.