Common use of SECURITY OBLIGATIONS OF THE PROCESSOR Clause in Contracts

SECURITY OBLIGATIONS OF THE PROCESSOR. As the title of this clause would suggest, it sets out the security obligations of the Data Processor with regard to the processing of personal data on behalf of the Data Controller. Important points to note are: - the Processor may only process personal data in accordance with instructions from the Data Controller. It may not process the data for its own purposes; - Appendix 1 of the Contract sets out the minimum requirements for compliance with these obligations. Appendix 1 is discussed further below. Clause 4 – Confidentiality This clause ensures that the Processor must treat all personal data processed on behalf of the Data Controller as confidential and provides that the obligation of confidentiality is continue for 5 years after the date on which the Processor ceases processing personal data for the Controller. This time limit is without prejudice to any longer time-limits that may be provided by national law or sector specific regulation. The

SECURITY OBLIGATIONS OF THE PROCESSOR. As the title of this clause would suggest, it sets out the security obligations of the Data Processor with regard to the processing of personal data on behalf of the Data Controller. Important points to note are: - the Processor may only process personal data in accordance with instructions from the Data Controller. It may not process the data for its own purposes; - Appendix 1 of the Contract sets out the minimum requirements for compliance with these obligations. Appendix 1 is discussed further below. Clause 4 – Confidentiality This clause ensures that the Processor must treat all personal data processed on behalf of the Data Controller as confidential and provides that the obligation of confidentiality is continue for 5 years after the date on which the Processor ceases processing personal data for the Controller. This time limit is without prejudice to any longer time-limits that may be provided by national law or sector specific regulation. TheThe parties may wish to amend this provision to reflect such additional obligations.