a Data Subject Access Request (or purported Data Subject Access Request) ; a request to rectify, block or erase any Personal Data; any other request, complaint, communication relating to either Party’s obligations under the Data Protection Legislation; receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Contract; receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or becomes aware of a Data Loss Event. The obligation to notify under clause 31.5 shall include the provision of further Contractor’s information to the Impact Commissioning Partner in phases, as details become available. Taking into account the nature of the processing, the Service Providershall provide the Impact Commissioning Partner with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under clause 31.5 (and insofar as possible within the timescales reasonably required by the Impact Commissioning Partner) including by promptly providing: the Impact Commissioning Partner with full details and copies of the complaint, communication or request; such assistance as is reasonably requested by the Impact Commissioning Partner to enable the Impact Commissioning Partner to comply with a Data Subject Access Request within the relevant timescales set out in the Data Protection Legislation; the Impact Commissioning Partner, at its request, with any Personal Data it holds in relation to a Data Subject; assistance as requested by the Impact Commissioning Partner following any Data Loss Event; assistance as requested by the Impact Commissioning Partner with respect to any request from the Information Office, or any consultation by Commissioner’s the Impact Commissioning Partner with the Information Commissioner's Office. The Service Providershall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Service Provideremploys fewer than 250 staff, unless: the Impact Commissioning Partner determines that the processing is not occasional; the Impact Commissioning Partner determines the processing includes special categories of data as referred to in Article 9(1) of the GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the GDPR; and
a Data Subject Access Request (or purported Data Subject Access Request) ; a request to rectify, block or erase any Personal Data; any other request, complaint, communication relating to either Party’s obligations under the Data Protection Legislation; receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Contract; receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or becomes aware of a Data Loss Event. The Contractor’s obligation to notify under clause 31.5 shall include the provision of further information to the Impact Commissioning Partner in phases, as details become available. Taking into account the nature of the processing, the Service Providershall provide the Impact Commissioning Partner with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under clause 31.5 (and insofar as possible within the timescales reasonably required by the Impact Commissioning Partner) including by promptly providing: the Impact Commissioning Partner with full details and copies of the complaint, communication or request; such assistance as is reasonably requested by the Impact Commissioning Partner to enable the Impact Commissioning Partner to comply with a Data Subject Access Request within the relevant timescales set out in the Data Protection Legislation; the Impact Commissioning Partner, at its request, with any Personal Data it holds in relation to a Data Subject; assistance as requested by the Impact Commissioning Partner following any Data Loss Event; assistance as requested by the Impact Commissioning Partner with respect to any request from the Information Commissioner’s Office, or any consultation by the Impact Commissioning Partner with the Information Commissioner's Office. The Service Providershall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Service Provideremploys fewer than 250 staff, unless: the Impact Commissioning Partner determines that the processing is not occasional; the Impact Commissioning Partner determines the processing includes special categories of data as referred to in Article 9(1) of the GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the GDPR; and
f-order-form-and-terms-and-conditions.docx