Common use of Processor Obligations Clause in Contracts

Processor Obligations. 9.1 Jisc (as a Processor in relation to any Institution Data Processed by (or on behalf of) the Institution pursuant to this Agreement) undertakes to the Institution that it shall: Process the Institution Data for and on behalf of the Institution in connection with the performance of the Learning Analytics Services only and for no other purpose in accordance with the terms of this Agreement and (without prejudice to Clause 12) any instructions from the Institution; unless prohibited by law, promptly notify the Institution (and in any event within forty‐ eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable EU Law to act other than in accordance with the instructions of the Institution, including where it believes that any of the Institution's instructions under Clause 9.1.1 infringes any of the Data Protection Legislation; implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. A description of the technical and organisational security measures that Jisc will implement and maintain from time to time is set out on the Jisc Site; take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Institution Data, and ensure that each member of Personnel shall have entered into appropriate contractually‐binding confidentiality undertakings; notify the Institution promptly, and in any event within forty‐eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and:

Processor Obligations. 9.1 Jisc (as a Processor in relation to any Institution Data Processed by (or on behalf of) the Institution pursuant to this Agreement) undertakes to the Institution that it shall: Process the Institution Data for and on behalf of the Institution in connection with the performance of the Learning Analytics Services only and for no other purpose in accordance with the terms of this Agreement and (without prejudice to Clause 12) any instructions from the Institution; unless prohibited by law, promptly notify the Institution (and in any event within forty‐ forty- eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable EU Law to act other than in accordance with the instructions of the Institution, including where it believes that any of the Institution's instructions under Clause 9.1.1 infringes any of the Data Protection Legislation; implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. A description of the technical and organisational security measures that Jisc will implement and maintain from time to time is set out on the Jisc Site; take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Institution Data, and ensure that each member of Personnel shall have entered into appropriate contractually‐binding contractually-binding confidentiality undertakings; notify the Institution promptly, and in any event within forty‐eight forty-eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and:

Processor Obligations. 9.1 Jisc (as a Processor in relation to any Institution Data Processed by (or on behalf of) the Institution pursuant to this Agreement) undertakes to the Institution that it shall: Process the Institution Data for and on behalf of the Institution in connection with the performance of the Learning Analytics Services only and for no other purpose in accordance with the terms of this Agreement and (without prejudice to Clause 12) any instructions from the Institution; unless prohibited by law, promptly notify the Institution (and in any event within forty‐ forty-eight (48) hours of becoming aware of the same) if it considers, in its opinion (acting reasonably) that it is required by Applicable EU Law to act other than in accordance with the instructions of the Institution, including where it believes that any of the Institution's instructions under Clause 9.1.1 infringes any of the Data Protection Legislation; implement and maintain appropriate technical and organisational security measures to comply with at least the obligations imposed on a Controller by the Security Requirements. A description of the technical and organisational security measures that Jisc will implement and maintain from time to time is set out on the Jisc Site; take all reasonable steps to ensure the reliability and integrity of any of the Personnel who shall have access to the Institution Data, and ensure that each member of Personnel shall have entered into appropriate contractually‐binding contractually-binding confidentiality undertakings; notify the Institution promptly, and in any event within forty‐eight forty-eight (48) hours, upon becoming aware of any actual or suspected, threatened or ‘near miss’ Personal Data Breach, and: