IRON MOUNTAIN RIGHTS AND OBLIGATIONS. 3.1. Iron Mountain shall (i) not use personal data for any purposes other than those specified in the Agreement and this DPA;
IRON MOUNTAIN RIGHTS AND OBLIGATIONS. 3.1. Iron Mountain shall (i) not use personal data for any purposes other than those specified in the Agreement and this DPA; (ii) process personal data in accordance with the Data Protection Regulation and with prevailing information management industry standards; (iii) process personal data in accordance with documented instructions from the Customer (taking into account Section 2 (ii)), and immediately inform the Customer if, in its opinion, an instruction infringes the Data Protection Regulation, (iv) to the extent feasible and subject to any applicable fees in the Agreement, assist the Customer in its response to rights exercised by data subjects, (v) subject to any applicable fees in the Agreement, assist the Customer in its response to powers exercised by Supervisory Authorities under the Data Protection Regulation; (vi) provide the Customer with all information necessary to demonstrate compliance with Iron Mountain’s obligations set out in this DPA and in the Data Protection Regulation; (vii) allow for and contribute to audits, including inspections conducted by the Customer as set forth (and subject to the limitations) in Section 5 of this DPA; (viii) ensure that its personnel/subcontractors authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, (ix) provide reasonable assistance to the Customer with any data protection impact assessments and with any prior consultations to a Supervisory Authority, in each case where these are required by the Data Protection Regulation, and solely in relation to processing of personal data by Iron Mountain on behalf of the Customer, and taking into account the nature of the processing and information available to Iron Mountain.
