Common use of Subject Access Requests Clause in Contracts

Subject Access Requests. 12.1 Subject to clause 12.3, the Provider shall notify the Council immediately if it: (a) receives a Data Subject Access Request (or purported Data Subject Access Request); (b) receives a request to rectify, block or erase any Personal Data; (c) receives any other request, complaint or communication relating to either Party's obligations under the Data Protection Legislation; (d) receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement; (e) receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or (f) becomes aware of a Data Loss Event. 12.2 The Contractor’s obligation to notify under clause 12.1 shall include the provision of further information to the Council in phases, as details become available. 12.3 The Provider acknowledges that the Council is responsible for responding to requests from individuals for access to their Personal Data and shall assist and cooperate with the Council in complying with its statutory obligations. 12.4 The Provider shall: 12.4.1 transfer the Subject Access Request to the Council as soon as practicable and in any event within three Working Days of receipt; 12.4.2 ensure that once in receipt or made aware that a Subject Access Request has been submitted, all the requested information is retained for potential disclosure; 12.4.3 provide the Council with a copy of all the Personal Data in its possession (including the sources of the information), in the form the Council requires within seven Working Days of receiving the request (or such shorter period as may be specified); and 12.4.4 provide all necessary assistance as reasonably requested to enable the Council to respond to the Subject Access Request within the time for compliance set out in Data Protection Legislation. 12.5 Under no circumstances shall the Provider respond directly to a Subject Access Request unless expressly authorised to do so in writing by the Council.