Common use of Storage, Return or Destruction of JPMC Data Clause in Contracts

Storage, Return or Destruction of JPMC Data. Supplier will accurately and completely collect and maintain information regarding the storage location, media, and method of storage of all JPMC Data on an ongoing basis. Unless expressly set forth in the applicable Schedule, if Supplier stores JPMC Data (including any and all copies, whether in production, backup or archival) it will do so on media logically and physically separate from other media used to store data of other Supplier clients. Further, in addition to the return and/or destruction obligations under Section 11.5, with respect to JPMC Data, prior to termination of the applicable Schedule, or on a date otherwise reasonably specified by JPMC, Supplier will: (a) meet with JPMC representatives to prepare and implement a plan for the return of all JPMC Data (in a format reasonably requested by JPMC); and (b) return to JPMC all JPMC Data as requested by JPMC. To the extent applicable record retention Laws require Supplier to have access to JPMC Data after termination or expiration of the applicable Schedule or JPMC’s request for return or destruction, unless expressly set forth in an applicable Schedule, Supplier will provide those requirements to JPMC. Additionally, upon JPMC’s written direction, Supplier will either: (i) Securely Delete electronic JPMC Data from all media within 10 Business Days of that direction or (ii) to the extent that JPMC Data is in a form or media other than electronic, comply with JPMC’s written instructions to Securely Delete that JPMC Data. Within 15 Business Days of that direction, Supplier will cause an officer of Supplier to certify to JPMC in writing that Supplier has complied with its obligations under clause (i) and (ii), as the case may be, including in compliance with JPMC’s instructions. To the extent that JPMC Data cannot be so Securely Deleted due to technical or other reasons reasonably acceptable to JPMC, and to the extent JPMC expressly agrees in writing, Supplier will promptly provide a written description of measures to be taken that will ensure, for as long as any JPMC Data remains under Supplier’s or its subcontractors’ control, the continued protection of such JPMC Data, in compliance with the requirements of Section 20 and Section 11. “

Storage, Return or Destruction of JPMC Data. (a) Supplier will accurately and completely collect and maintain information regarding the storage location, media, and method of storage of all JPMC Data and/or records on an ongoing basis. Unless expressly set forth in the applicable Schedule, if Supplier stores JPMC Data and/or records (including any and all copies, whether in production, backup or archival) it will do so on media logically and physically separate from other media used to store data of other Supplier clientsclients and in accordance with the record retention guidelines set forth in the applicable Schedule. Further, in addition to the return and/or destruction obligations under Section 11.513.4, with respect to JPMC Data, prior to termination of the applicable Schedule, or on a date otherwise reasonably specified by JPMC, Supplier will: (a) meet with JPMC representatives to prepare and implement a plan for the return of all JPMC Data (in a format reasonably requested by JPMC); and (b) return to JPMC all JPMC Data as requested by JPMC. To the extent applicable record retention Laws require Supplier to have access to JPMC Data after termination or expiration of the applicable Schedule or JPMC’s request for return or destruction, unless expressly set forth in an applicable Schedule, Supplier will provide those requirements to JPMC. JPMC is entitled to engage, on terms reasonably acceptable to JPMC, and at JPMC’s sole cost and expense, an escrow agent to hold in escrow the JPMC Data (which escrow agent will be deemed JPMC’s designee for purposes of Section 13.4). To the extent any JPMC Data is returned by the escrow agent to Supplier, Section 13 and this Section 12 will again apply to that returned JPMC Data. Additionally, upon JPMC’s written direction, Supplier will either: (i) Securely Delete electronic JPMC Data from all media within 10 Business Days of that direction or (ii) to the extent that JPMC Data is in a form or media other than electronic, comply with JPMC’s written instructions to Securely Delete that JPMC Data. Within 15 Business Days of that direction, Supplier will cause an officer of Supplier to certify to JPMC in writing that Supplier has complied with its obligations under clause (i) and (ii), as the case may be, including in compliance with JPMC’s instructions. To the extent that JPMC Data cannot be so Securely Deleted due to technical or other reasons reasonably acceptable to JPMC, and to the extent JPMC expressly agrees in writing, Supplier will promptly provide a written description of measures to be taken that will ensure, for as long as any JPMC Data remains under Supplier’s or its subcontractors’ control, the continued protection of such JPMC Data, in compliance with the requirements of this Section 20 12 and Section 1113. “Securely Delete” means using any and all means, including in compliance with the then-current version of National Institute for Standards and Technology (“NIST”), Special Page 50 Publication 800-88, Guidelines for Media Sanitization (and its appendices) and any written instructions of JPMC for sanitizing or deleting all data and information to ensure that the data and information is permanently sanitized, deleted and unrecoverable from any and all media, in whole or in part, by any means. In no event will Supplier remove or have removed any JPMC Data from Supplier’s or any subcontractor’s site without JPMC’s prior written authorization.