Joint controllership. (1) Unless otherwise agreed below, each Party shall ensure compliance with the legal regulations, in particular the lawfulness of the processing activities carried out by it.
Joint controllership. Where any Project Contract entered into in relation to Clause 7(1)(c) above indicates that any of the Academic Parties are joint Controllers with COMPASS with regards to any of the Personal Data processed pursuant to this MRCA, the Parties shall agree a responsibility matrix in writing prior to carrying out any processing of Personal Data contemplated under the relevant Project Contract. This responsibility matrix shall set out each of the relevant Party’s responsibility for performing the obligations imposed on Controllers under Data Protection Laws (particularly relating to transparency and Data Subject rights) and shall be appended to the relevant Pillar Overview Plan once agreed. The Parties shall agree a written summary of this responsibility matrix which can be made available to Data Subjects on request.
Joint controllership. The Parties agree that while data subjects may exercise their rights against either controller, Defra will be responsible for providing data subjects with privacy notices regarding Article 13 and 14 of the UK GDPR. Furthermore, Defra will make themselves the primary contact point for responding to Data Subject Rights Requests. If either of the Parties receives a Data Subject Access Request and / or a Data Subject Rights Request which relates in whole or in part to shared data transferred by them to the other Party to this Agreement they will notify the other Party to this Agreement within seven calendar days of receipt so that Defra can respond to the request within the required time limit. The parties will cooperate to ensure that Data Subject Rights Requests are completed within one calendar month. If any of the Parties receives a Data Subject Access Request and / or a Data Subject Rights Request which relates in whole or in part to shared data, and the responsibilities of another party set out above, this request must be transferred to that Party within seven calendar days of receipt so that they can respond to the request within one calendar month. Third Party sharing The Parties recognise the potential risk to the rights and freedoms of individuals occurring as a result of unauthorised disclosure, modification or theft of the shared data. The Data Recipient will not transfer the shared data to a third party or third parties without first obtaining the express and written consent of the Data Owner. Any agreed onward transfer of the shared data by the Recipient Organisation must carry the same standard of conditions and protections as set out in this Agreement. The Recipient Organisation will obtain the written consent of the Data Owner by completing Xxxxx X and obtaining the signature of a designated representative of the Data Owner. Publishing None of the shared data and/or material received will be published by either of the Parties in such a way that information relating to any particular person, land, or business can be identified or inferred from it nor should it be used for any commercial purposes or for any other purposes incompatible with the Agreement. Incidents and Breaches If either of the Parties becomes aware of any actual or potential data security breach or personal data breach relating to the shared data, it should inform the other Parties immediately (no later than 12 hours from the time of discovery) by emailing for JNCC - xxxxxxxxxxx...
