General Data Protection
1. Each party shall ensure that it shall comply with the provisions and obligations imposed on it by Regulations relating to data protection.
2. The company or individual, as supplier to Lancashire Environmental Services warrants and undertakes to comply with the Data Protection Act 1998 (“DPA 1998”) (and when it comes into force in the UK, the General Data Protection Regulation (Regulation (EU) 2016/679), when obtaining, maintaining, utilising and storing personal data in any format (as defined in DPA 1998).
3. All personal data acquired by a party from the other shall be returned or deleted (at the option of the requesting party) on request save to the extent required by that party to discharge its obligations under this Agreement or under any Regulations.
4. The company or individual as supplier shall establish and maintain appropriate technical and organisational measures against accidental, unauthorised or unlawful processing of , access to, loss of, or damage or relevant Personal Data (any such event being a Data Protection Event), and shall regularly test, assess and evaluate those measures.
5. The measures to be adopted under clause 4 shall ensure a level of security appropriate to the harm that might result from a Data Protection Event and the nature of the Relevant Personal Data, having regard to the state of technological development and the cost of implementing the methods.
6. The company or individual as supplier shall:
a) take reasonable steps to ensure the reliability of its employees and other personnel who have access to Relevant Personal Data.
b) provide training for Relevant Personnel so that they are aware of obligations under Regulations relating to data protection and inform them of the importance of the need to avoid Data Protection Events.
c) have in place disciplinary procedures in respect of non-compliance with relevant data protection requirements and standards.
d) ensure that persons authorised to process Relevant Personal Data have committed themselves to be bound by confidentiality provisions or are under an appropriate statutory obligation of confidentiality; and
e) appoint a person to be responsible for security and data protection matters and provide the name of the person to the other on request.
7. The company or individual as supplier shall promptly and in any event no later than reasonably required in order to enable Lancashire Environmental Services to fulfil its duties under Regulations relating to data protection.
a) Provide such information as Lancashire Environmental Services may reasonably require in relation to Relevant Personal Data or its processing;
b) Pass on any enquiries or communications (including subject access requests) from individuals relating to their Relevant Personal Data or its processing;
c) Provide all information extracted from Relevant Personal Data as may be required for the purpose of responding to any individual or otherwise to comply with duties under Regulations relating to data protection; and
d) Report to the Data Controller, Lancashire Environmental Services, without delay any security incidents or breaches relating to the Relevant Personal Data and provide such information and co-operation as Lancashire Environmental Services may reasonably require in relation to the incident or breach.
8. Except on documented instructions from Lancashire Environmental Services or otherwise provided by this Agreement, the company or individual as supplier shall not transfer any Relevant Personal Data to any country or territory outside the European Union or to any international organisation (as defined in Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016).
9. As soon as reasonably practicable after a request from Lancashire Environmental Services, the company or individual as supplier shall enter into any deed or other document with Lancashire Environmental Services in order to enable them to comply with Regulations relating to data protection that may prevail at that time. REVISION OF POLICY This policy is not intended to be contractually binding. The Company reserves the right to amend without consultation and/or withdraw this policy for any reason, including without limitation, to take account of changes in the law, best practice and/or business requirements.