- Data Protection Definitions
1.1 In this Schedule:
1.1.1 “Controller” has the same meaning as in the Data Protection Legislation;
1.1.2 “Data Protection Legislation” means the GDPR, the DPA, and any national implementing laws, regulations and secondary legislation relating to the protection of Personal Data and the privacy of individuals, in the UK; all as amended or updated from time-to-time;
1.1.3 “Data Subject” means a data subject, as defined in the Data Protection Legislation, and as set out in Annex 1;
1.1.4 “Disclosing Party” means the party disclosing Personal Data to the other party under this Contract;
1.1.5 “DPA” means the UK Data Protection Act 2018;
1.1.6 “GDPR” means the General Data Protection Regulation (EU) 2016/679 (or such replacement thereof in the UK upon the UK leaving the European Economic Area (“EEA”);
1.1.7 “Personal Data” means the “personal data” (as defined in the Data Protection Legislation) Processed under this Contract in respect of which the Disclosing Party is a data Controller that are made available to the Recipient under this Contract, as set out in the table in Annex 1;
1.1.8 “Purposes” means the purposes for Processing the Personal Data set out in the table in Annex 1;
1.1.9 “Processing” has the same meaning as in the Data Protection Legislation and “Process” and “Processed” shall be construed accordingly; and
1.1.10 “Recipient” means the party receiving Personal Data from the other party under this Contract;
1.1.11 “Recipient Personnel” means all employees, agents, consultants and contractors of the Recipient;
1.1.12 “Subject Access Request” means a subject access request (or any apparent subject access request) in respect of any Data Subject under the Data Protection Legislation; and
1.1.13 “Third Party Recipient” means any third parties authorised to receive the Personal Data from the Recipient, as set out in the table in Annex 1 as may be varied from time to time in accordance with clause 5.5.
2. Status of the parties
2.1 The parties acknowledge that for the purposes of this Schedule, each party will be acting as a Controller in respect of the Personal Data and will be responsible for compliance with the Data Protection Legislation in respect of its Processing of the Personal Data.
2.2 The Disclosing Party shall be responsible for ensuring that the relevant Data Subjects have been provided with privacy information in respect of this data sharing arrangement.
3. The Recipient’s obligations
3.1 In consideration of being granted access to the Personal Data, the Recipient shall:
3.1.1 take reasonable steps to ensure the reliability of the Recipient Personnel and any Third Party Recipients who have access to the Personal Data and use all reasonable endeavours to ensure that such persons have sufficient skills and training in handling Personal Data and comply with the Data Protection Legislation;
3.1.2 implement appropriate technical and organisational measures in accordance with the Data Protection Legislation to ensure a level of security appropriate to the risks presented by such Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the likelihood and severity of risk to the rights and freedoms of the Data Subjects;
3.1.3 comply with all applicable laws including but not limited to the Data Protection Legislation in relation to all processing of the Personal Data;
3.1.4 not Process the Personal Data for any purposes other than the Purposes;
3.1.5. not disclose the Personal Data to any third parties other than any Third Party Recipients and ensure that any Third Party Recipients are subject to obligations equivalent to those of the Recipient under this Contract;
3.1.6 comply with any other obligations of the Recipient set out in Annex 1;
3.1.7 not cause or permit the Personal Data to be transferred outside the Recipient’s country without the Disclosing Party’s prior written consent; and
3.1.8 permit the Disclosing Party (subject to reasonable and appropriate confidentiality undertakings) to inspect and audit the Recipient’s data Processing and/or controlling activities and comply with all reasonable requests or directions by the Disclosing Party to enable the Disclosing Party to verify and/or procure that the Recipient is in full compliance with its obligations under this Contract.
3.2 Each party shall only retain the Personal Data for as long as is necessary for the Purposes.
3.3. The provisions of this clause 3 shall survive the termination of this Contract, however arising.
4. Warranties and indemnity
4.1 The Recipient warrants and undertakes that in carrying out its obligations under this Contract it will not breach the Data Protection Legislation or do or omit to do anything that might cause the Disclosing Party to be in breach of the Data Protection Legislation.
4.2 The Recipient shall indemnify the Disclosing Party against any costs, claims, expenses (including but not limited to reasonable legal costs) damages, liabilities, actions and proceedings brought against the Disclosing Party by any third party (including but not limited to the Data Subjects) arising out of a breach of this Contract by the Recipient and/or any Recipient Personnel.
5. Information governance
5.1 Each party shall monitor the Personal Data to ensure that it is accurate and up to date and shall destroy any Personal Data that is inaccurate or out of date.
5.2 The parties shall agree the following details to the extent that these are not covered in this Contract:
5.2.1 the prescribed format for datasets (to ensure datasets are compatible);
5.2.2. common rules for the retention and deletion of Personal Data; and
5.2.3 common technical and organisational security arrangements including for the transmission of the Personal Data.
5.3 The parties shall hold a six monthly review meeting (or such other frequency as may be agreed by the parties in writing) to review the ongoing effectiveness of the data sharing activities under this Contract and agree any appropriate changes.
5.4 Where the Disclosing Party reasonably suspects that the Recipient is not in full compliance with its obligations under this Contract, the Disclosing Party may:
5.4.1. terminate this Contract with immediate effect; and/or
5.4.2 require the Recipient to attend a meeting between the parties at which the Recipient will be expected to present, and gain acceptance for, a plan to avoid repetition of the failure, which the Recipient shall promptly implement following such meeting.
5.5 The parties may by prior written agreement include any additional Third Party Recipients within the scope of this Contract, or elect to exclude any Third Party Recipients from receiving any Personal Data.
6. Communications
6.1 Advance HE shall take overall responsibility for ensuring that the Data Subjects may gain access to the Personal Data in the event of any Subject Access Request.
6.2 Where either party receives a Subject Access Request in relation to the Personal Data (“Request Recipient”), it shall as soon as reasonably practicable after receipt and in any event within five calendar days of receipt, forward the Subject Access Request to the other party and the other party shall:
6.2.1 provide the Request Recipient with a copy of all such information in the form that the Request Recipient requires as soon as practicable and in any event within 10 calendar days (or such other period as the Request Recipient acting reasonably may specify) of the Request Recipient’s request; and
6.2.2 provide all necessary assistance as reasonably requested by the Request Recipient to enable the Request Recipient to respond to the Subject Access Request within the time for compliance set out in the Data Protection Legislation.
6.3 Where either party receives a complaint or query from any member of the public, that party shall promptly notify the other party and shall deal with the complaint or query without undue delay and shall not do anything that is likely to damage the reputation of the other party.
