XxxX Solution Provider Obligations. Without prejudice to the foregoing, the XxxX Solution Provider shall: to the extent that the XxxX Solution Provider Processes any XxxX Solution Data as a Processor, without prejudice to the foregoing, only Process the XxxX Solution Data for and on behalf of the Combined Authority for the Permitted Purpose, and only in accordance with the terms of this Agreement and any documented instructions from the Combined Authority, unless the XxxX Solution Provider is required by Data Protection Legislation to otherwise Process the XxxX Solution Data. Where the XxxX Solution Provider is relying upon Data Protection Legislation as the basis for Processing XxxX Solution Data it shall immediately notify the Combined Authority of this before performing the Processing required by the Data Protection Legislation, unless Data Protection Legislation prohibits the XxxX Solution Provider from so notifying the Combined Authority on important grounds of public interest; take, implement and maintain appropriate technical and organisational security measures to protect the XxxX Solution Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to XxxX Solution Data Processed by it, including (inter alia) where appropriate: compliance with the obligations imposed on the XxxX Solution Provider by the Specification; the pseudonymisation and encryption of the XxxX Solution Data; the ability to ensure ongoing confidentiality, integrity, availability and resilience of Processing systems and services; the ability to restore the availability and access to the XxxX Solution Data in a timely manner in the event of a physical or technical incident; regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing; and ensuring that any device which is used to Process XxxX Solution Data meets all of the Cybersecurity Requirements. In assessing the appropriate level of security, the XxxX Solution Provider shall take into account the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to XxxX Solution Data transmitted, stored or otherwise Processed. In doing so, the XxxX Solution Provider shall also consider the nature and the volume of the data to be protected, the harm that might result, the state of technological development concerning security measures available a...
XxxX Solution Provider Obligations. 3.3.1 Without prejudice to the foregoing, the XxxX Solution Provider shall:
