Common use of Provision of Assistance and Cooperation Clause in Contracts

Provision of Assistance and Cooperation. 3.1 The Processor shall provide the Controller with all necessary assistance and cooperation in enforcing the obligations of the Parties under the GDPR and other applicable laws and regulations concerning the Processing of Personal Data. To the extent that such assistance relates to the Processing of Personal Data for the purpose of the performance of the Agreement, the Processor shall in any event provide the Controller with such assistance relating to: (i) The security of Personal Data; (ii) Performing checks and audits; (iii) Performing DPIAs; (iv) Prior consultation with the Supervisory Authority; (v) Responding to requests from the Supervisory Authority or another government body; (vi) Responding to requests from Data Subjects; (vii) Reporting Personal Data Breaches. 3.2 The provision of assistance and cooperation with regard to meeting the requests from Data Subjects will in any event include the following obligations on the part of the Processor: 3.2.1 The Processor shall take all reasonable measures to ensure that the data subject can exercise his rights. 3.2.2 If a Data Subject contacts the Processor directly with regard to exercising his rights, the Processor - unless explicitly instructed otherwise by the Controller - will not (substantively) respond to this, but will immediately inform the Controller and request further instructions. 3.2.3 If the Processor offers the Service directly to the Data Subject, the Processor is obliged to inform the Data Subject on behalf of the Controller about the Processing of the Personal Data of the Data Subject in a manner that is in accordance with the rights of the Data Subject. 3.3 The provision of assistance and cooperation with regard to meeting requests from the Supervisory Authority or another government body shall in any case constitute the following obligations for the Processor: 3.3.1 If the Processor receives a request or an order from a Dutch and/or foreign government agency with respect to Personal Data, including but not limited to a request from the Supervisory Authority, the Processor shall inform the Controller immediately, to the extent permitted by law. When handling the request or order, the Processor shall observe all instructions of the Controller and the Processor shall provide the Controller with all reasonably necessary cooperation. 3.3.2 If the Processor is prohibited by law from fulfilling its obligations under Article 3.3.1, the Processor shall represent the reasonable interests of the Controller. This is in all cases understood to mean: 3.3.2.1 The Processor shall have a legal assessment carried out of the extent to which: (i) the Processor is legally obliged to comply with the request or order; and (ii) the Processor is effectively prohibited from complying with its obligations in respect of the Controller under Article 3.3.1. 3.3.2.2 The Processor shall only cooperate with the request or order if the Processor is legally obliged to do so and, where possible, the Processor shall (judicially) object to the request or order or the prohibition to inform the Controller about this or to follow the instructions of the Controller. 3.3.2.3 The Processor shall not provide more Personal Data than is strictly necessary for complying with the request or order. 3.3.2.4 In the event of a transfer within the meaning of Article 8, the Processor shall examine the possibilities of complying with Articles 44 up to and including 46 of the GDPR.

Provision of Assistance and Cooperation. 3.1 The Processor shall provide the Controller with all necessary assistance and cooperation in enforcing the obligations of the Parties under the GDPR and other applicable laws and regulations concerning the Processing of Personal Data. To the extent that such assistance relates to the Processing of Personal Data for the purpose of the performance of the Agreement, the Processor shall in any event provide the Controller with such assistance relating to: (i) : The security of Personal Data; (ii) ; Performing checks and audits; (iii) ; Performing DPIAs; (iv) ; Prior consultation with the Supervisory Authority; (v) ; Responding to requests from the Supervisory Authority or another government body; (vi) ; Responding to requests from Data Subjects; (vii) ; Reporting Personal Data Breaches. 3.2 The provision of assistance and cooperation with regard to meeting the requests from Data Subjects will in any event include the following obligations on the part of the Processor: 3.2.1 The Processor shall take all reasonable measures to ensure that the data subject can exercise his rights. 3.2.2 If a Data Subject contacts the Processor directly with regard to exercising his rights, the Processor - unless explicitly instructed otherwise by the Controller - will not (substantively) respond to this, but will immediately inform the Controller and request further instructions. 3.2.3 If the Processor offers the Service directly to the Data Subject, the Processor is obliged to inform the Data Subject on behalf of the Controller about the Processing of the Personal Data of the Data Subject in a manner that is in accordance with the rights of the Data Subject. 3.3 The provision of assistance and cooperation with regard to meeting requests from the Supervisory Authority or another government body shall in any case constitute the following obligations for the Processor: 3.3.1 If the Processor receives a request or an order from a Dutch and/or foreign government agency with respect to Personal Data, including but not limited to a request from the Supervisory Authority, the Processor shall inform the Controller immediately, to the extent permitted by law. When handling the request or order, the Processor shall observe all instructions of the Controller and the Processor shall provide the Controller with all reasonably necessary cooperation. 3.3.2 If the Processor is prohibited by law from fulfilling its obligations under Article 3.3.1, the Processor shall represent the reasonable interests of the Controller. This is in all cases understood to mean: 3.3.2.1 The Processor shall have a legal assessment carried out of the extent to which: (i) the Processor is legally obliged to comply with the request or order; and (ii) the Processor is effectively prohibited from complying with its obligations in respect of the Controller under Article 3.3.1. 3.3.2.2 The Processor shall only cooperate with the request or order if the Processor is legally obliged to do so and, where possible, the Processor shall (judicially) object to the request or order or the prohibition to inform the Controller about this or to follow the instructions of the Controller. 3.3.2.3 The Processor shall not provide more Personal Data than is strictly necessary for complying with the request or order. 3.3.2.4 In the event of a transfer within the meaning of Article 8, the Processor shall examine the possibilities of complying with Articles 44 up to and including 46 of the GDPR.

Provision of Assistance and Cooperation. 3.1 The Processor shall provide the Controller with all necessary assistance and cooperation in enforcing the obligations of the Parties under the GDPR and other applicable laws and regulations concerning the Processing of Personal Data. To the extent that such assistance relates to the Processing of Personal Data for the purpose of the performance of the Agreement, the Processor shall in any event provide the Controller with such assistance relating to: (i) : The security of Personal Data; (ii) ; Performing checks and audits; (iii) ; Performing DPIAs; (iv) ; Prior consultation with the Supervisory Authority; (v) ; Responding to requests from the Supervisory Authority or another government body; (vi) ; Responding to requests from Data Subjects; (vii) ; Reporting Personal Data Breaches. 3.2 . The provision of assistance and cooperation with regard to meeting the requests from Data Subjects will in any event include include, but is not limited to, the following obligations on the part of the Processor: 3.2.1 : The Processor shall take all reasonable measures to ensure that the data subject can exercise his rights. 3.2.2 . If a Data Subject contacts the Processor directly with regard to exercising his rights, the Processor - – unless explicitly instructed otherwise by the Controller - will not (substantively) respond to this, but will immediately inform the Controller and request further instructions. 3.2.3 . If the Processor offers the Service directly to the Data Subject, the Processor is obliged to inform the Data Subject on behalf of the Controller about the Processing of the Personal Data of the Data Subject in a manner that is in accordance with the rights of the Data Subject. 3.3 . When informing Data Subjects, the Processor refers to the Controller’s privacy statement, which can be found on: xxxxx://xxx.xx.xx/english/vaste-onderdelen/privacy-statement-radboud-university/. The provision of assistance and cooperation with regard to meeting requests from the Supervisory Authority or another government body shall in any case constitute the following obligations for the Processor: 3.3.1 : If the Processor receives a request or an order from a Dutch and/or foreign government agency with respect to Personal Data, including but not limited to a request from the Supervisory Authority, the Processor shall inform the Controller immediately, to the extent permitted by law. When handling the request or order, the Processor shall observe all instructions of the Controller and the Processor shall provide the Controller with all reasonably necessary cooperation. 3.3.2 . If the Processor is prohibited by law from fulfilling its obligations under Article 3.3.1, the Processor shall represent the reasonable interests of the Controller. This is in all cases understood to mean: 3.3.2.1 The Processor shall have a legal assessment carried out of the extent to which: (i) the Processor is legally obliged to comply with the request or order; and (ii) the Processor is effectively prohibited from complying with its obligations in respect of the Controller under Article 3.3.1. 3.3.2.2 1. The Processor shall only cooperate with the request or order if the Processor is legally obliged to do so and, where possible, the Processor shall (judicially) object to the request or order or the prohibition to inform the Controller about this or to follow the instructions of the Controller. 3.3.2.3 . The Processor shall not provide more Personal Data than is strictly necessary for complying with the request or order. 3.3.2.4 . In the event of a transfer within the meaning of Article 8, the Processor shall examine the possibilities of complying with Articles 44 up to and including 46 of the GDPR.

Provision of Assistance and Cooperation. 3.1 The Processor shall provide the Controller with all necessary assistance and cooperation in enforcing the obligations of the Parties under the GDPR and other applicable laws Applicable Laws and regulations Regulations concerning the Processing of Personal Data. To the extent that such assistance relates to the Processing of Personal Data for the purpose of the performance of the Agreement, the Processor shall in any event provide the Controller with such assistance relating to: (i) : The security of Personal Data; (ii) ; Performing checks and audits; (iii) ; Performing DPIAs; (iv) ; Prior consultation with the Supervisory Authority; (v) ; Responding to requests from the Supervisory Authority or another government body; (vi) ; Responding to requests from Data Subjects; (vii) ; Reporting Personal Data Breaches. 3.2 The provision of assistance and cooperation with regard to meeting the requests from Data Subjects will in any event include is understood to include, but is not limited to, the following obligations on the part of for the Processor: 3.2.1 The Processor shall take all reasonable measures to ensure that the data subject Data Subject can exercise his rights. 3.2.2 If If, in relation to the exercise of his rights, a Data Subject contacts the Processor directly with regard to exercising his rightsdirectly, the Processor shall not (substantively) respond to this - unless explicitly expressly instructed otherwise by the Controller - will not (substantively) respond to this, but will shall immediately inform the Controller and request further instructions. 3.2.3 If the Processor offers the Service directly to the Data Subject, the Processor is obliged to inform the Data Subject on behalf of the Controller about the Processing of the Data Subject’s Personal Data of the Data Subject in a manner that is in accordance with the rights of the Data Subject. 3.3 The provision of assistance and cooperation with regard to meeting requests from the Supervisory Authority or another government body shall in any case constitute is understood to include, but is not limited to, the following obligations for the Processor: 3.3.1 If the Processor receives a request or an order concerning Personal Data from a Dutch and/or foreign government agency with respect to Personal Datapublic body, including but not limited to a request from the Supervisory Authority, the Processor shall inform immediately notify the Controller immediately, to the extent in so far as this is permitted by law. When handling the request or order, the Processor shall observe all instructions of the Controller Controller’s instructions and the Processor shall provide to the Controller with all reasonably necessary required cooperation. 3.3.2 If the Processor is prohibited by law from fulfilling its obligations under Article 3.3.1, the Processor shall represent the reasonable interests of the Controller’s. This is in all cases understood to mean: 3.3.2.1 The Processor shall have a legal assessment carried out of the extent to which: which (i) the Processor is legally obliged to comply with the request or order; and (ii) the Processor is effectively prohibited from complying with its obligations in respect of the Controller under Article 3.3.1. 3.3.2.2 The Processor shall only cooperate with the request or order if the Processor is legally obliged to do so and, where possibleposslbie, the Processor shall (judicially) object to the request or order or the prohibition to inform the Controller about this or to follow the instructions of the Controller. 3.3.2.3 The Processor shall not provide more Personal Data than is strictly necessary for complying with the request or order. 3.3.2.4 3.2.3.4 In the event of a transfer within the meaning of Article 8, the Processor shall examine the possibilities of complying with Articles 44 up to and including 46 of the GDPR.