33.5 The Supplier will not transfer Personal Data outside of the European Union unless the prior written consent of the Buyer has been obtained, which shall be dependent on such a transfer satisfying relevant Data Protection Legislation requirements. 33.6 The Supplier will delete or return Buyer’s Personal Data (including copies) if requested in writing by the Buyer at the End or Expiry of this Call-Off Contract, unless required to retain the Personal Data by Law. 33.7 The Supplier will notify the Buyer without undue delay if it receives any communication from a third party relating to the Parties’ obligations under the Data Protection Legislation, or it becomes aware of a Data Loss Event, and will provide the Buyer with full and ongoing assistance in relation to each Party’s obligations under the Data Protection Legislation, and insofar as this is possible, in accordance with any timescales reasonably required by the Buyer 33.8 The Supplier will maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Supplier employs fewer than 250 staff, unless: i) the Buyer determines that the Processing is not occasional; ii) the Buyer determines the Processing includes special categories of data as referred to in Article 9(1) of the GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the GDPR; and iii) the Buyer determines that the Processing is likely to result in a risk to the rights and freedoms of Data Subjects. 33.9 Before allowing any Sub-processor to Process any Personal Data related to this Call-Off Contract, the Supplier must: notify the Buyer in writing of the proposed Sub-processor(s) and obtain its written consent; ensure that it has entered into a written agreement with the which gives effect to obligations set out in this Clause 33 such that they apply to the Sub-processor(s); and inform the Buyer of any additions to, or replacements of the notified Sub-processors and the Buyer shall either i) provide its written consent or ii) object. 33.10 The may at any time put forward a Variation request to amend this Call-Off Contract to ensure that it complies with any guidance issued by the Information Commissioner’s Office.
33.5 The Supplier will not transfer Personal Data outside of the European Union unless the prior written consent of the Buyer has been obtained, which shall be dependent on such a transfer satisfying relevant Data Protection Legislation requirements. 33.6 The Supplier will delete or return Buyer’s Personal Data (including copies) if requested in writing by the Buyer at the End or Expiry of this Call-Off Contract, unless required to retain the Personal Data by Law. 33.7 The Supplier will notify the Buyer without undue delay if it receives any communication from a third party relating to the Parties’ obligations under the Data Protection Legislation, or it becomes aware of a Data Loss Event, and will provide the Buyer with full and ongoing assistance in relation to each Party’s obligations under the Data Protection Legislation, and insofar as this is possible, in accordance with any timescales reasonably required by the Buyer 33.8 The Supplier will maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Supplier employs fewer than 250 staff, unless: i) the Buyer determines that the Processing is not occasional; ii) the Buyer determines the Processing includes special categories of data as referred to in Article 9(1) of the GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the GDPR; and iii) the Buyer determines that the Processing is likely to result in a risk to the rights and freedoms of Data Subjects. 33.9 Before allowing any Sub-processor to Process any Personal Data related to this Call-Off Contract, the Supplier must: notify the Buyer in writing of the proposed Sub-processor(s) and obtain its written consent; ensure that it has entered into a written agreement with the which gives effect to obligations set out in this Clause 33 such that they apply to the Sub-processor(s); and inform the Buyer of any additions to, or replacements of the notified Sub-processors and the Buyer shall either i) provide its written consent or ii) object. 33.10 The may at any time put forward a Variation request to amend this Call-Off Contract to ensure that it complies with any guidance issued by the Information Commissioner’s Office.
RM1557.10%20Call%20off%20order%20form%20v3_0.docx