Technical and organisational provisions Sample Clauses

Technical and organisational provisions. (security) 1. The Controller will only make Personal Data available to the Processor for processing if the Controller has satisfied itself that the security measures required have been put in place and, also bearing in mind the provisions of Article 32 of the GDPR, guarantee an appropriate level of protection, given the state of the art and the cost of implementation, this in view of the risks associated with processing and the nature of the data to be protected. An overview of security measures has been included in Schedule 2. 2. The Controller will be entitled to inspect the measures put in place and also compliance with the obligations to which the Processor is subject. The Controller will bear all costs, payments and expenses arising in connection with an inspection. 3. If the Processor has become aware of a security breach as described in Section 34a of the Wbp and/or Article 4(12) of the GDPR (hereinafter: Data Leak), the Processor will notify the Controller in writing as soon as possible. Where possible, it will do so within 24 (twenty-four) hours of the time at which the Data Leak came to the attention of the Processor. 4. The Processor will provide the Controller with information about the following at the very least: (i) the nature of the breach, where possible stating the categories of the data subjects in question and the approximate number of data subjects; (ii) the personal data possibly affected and the approximate amount of personal data affected; (iv) the measures that the Processor has taken and will take to address the breach, including, where appropriate, measures to limit any negative consequences of the breach. 5. The Processor recognises that, in certain circumstances, the Controller is required by law to notify data subjects or authorities of a security breach of whatever nature that relates or could relate (in part) to the Personal Data that the Processor processes. A notification of this nature by the Controller will never be deemed to be a failure in the performance of this agreement, or the underlying agreement, or otherwise a wrongful or unlawful act. 6. If a Data Leak happens despite the measures taken by the Processor, as agreed with the Controller, the Controller will not be able to hold the Processor liable for any losses sustained by the Controller as a result.

Technical and organisational provisions. The provider is required to take all necessary technical and organisational measures to protect data provided by the client within the framework of the contract for the provision of IT services on the above-mentioned. For that purpose, the provider shall rely on the European Directive on the protection of personal data adopted by the European Parliament and Council on 24 October, 1995, including applicable national law and the information provided by the client.