7. Data Protection and Data Processing

7.1  

The Customer and the Supplier acknowledge that for the purposes of the Data Protection Act 2018 and Article 4 of the General Data Protection Regulation (EU) 2016/679 the Customer is the Data Controller and the Supplier is the data processor in respect of any Personal Data.

7.2  

The Supplier shall process the Personal Data only in accordance with the Customer's instructions from time to time and shall not process the Personal Data for any purposes other than those expressly authorised by the Customer.

7.3  

The Supplier shall take reasonable steps to ensure the reliability of all its employees who have access to the Personal Data.

7.4  

Each party warrants to the other that it will process the Personal Data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments.

7.5  

The Supplier warrants that, having regard to the state of technological development and the costs of implementing any measures, it will:

(a)  take appropriate technical and organisational measures against the unauthorised or unlawful processing of Personal Data and against the accidental loss or destruction of, or damage to, Personal Data to ensure a level of security appropriate to:

(i)  the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage; and

(ii)  the nature of the data to be protected; and

(b)  take reasonable steps to ensure compliance with those measures.

7.6  

Each party agrees to indemnify and keep indemnified and defend at its own expense the other party against all costs, claims, damages or expenses incurred by the other party or for which the other party may become liable due to any failure by the first party or its employees or agents to comply with any of its obligations under this clause 7.

7.7  

The Customer acknowledges that the Supplier is reliant on the Customer for direction as to the extent to which the Supplier is entitled to use and process the Personal Data. Consequently, the Supplier will not be liable for any claim brought by a Data Subject arising from any action or omission by the Supplier, to the extent that such action or omission resulted directly from the Customer's instructions.

7.8  

The Supplier may authorise a third party (subcontractor) to process the Personal Data provided that the subcontractor's contract:

(a)  is on terms which are substantially the same as those set out in the Contract; and

(b)  terminates automatically on termination of the Contract for any reason.

7.9

The Supplier take the protection and processing of personal data very seriously. We will handle and process data in accordance with our privacy notice which can be found on our website: View Breckland Council's Privacy Policy