3.1 Process personal data only to the extent necessary to provide their respective services under this Agreement and only in accordance with prior written instructions of the other (if required);

3.2 Immediately inform the other party if, its instruction infringes the Data Protection Legislation;

3.3 Ensure that every person processing personal data under this Agreement does so strictly on a need-to-know basis, has received training on their obligations relating to handling of personal data and is bound by confidentiality obligations no less stringent than our confidentiality obligations under this Agreement;

3.4 In order to use commonly accepted international communications and money transfer protocols, it will be necessary to use sub-contractors for certain service provision. The parties shall not necessarily be aware of the identity of every organisation involved in the train of communications. When that happens, each of the Agency and the Client accepts full responsibility for compliance with the Data Protection Legislation;

3.5 Subject to the exceptions mentioned in the last previous sub-paragraph, the Client will not use subcontractors for personal data processing under this Agreement without prior written consent of the Agency;

3.6 Wherever possible, enter into a written contract with each such sub-processor, which includes the same obligations on the sub-processor as those imposed on each of the Agency and the Client under this Agreement;

3.7 Subject to the other provisions of this Schedule, not process personal data or permit any third party to process personal data outside of the United Kingdom unless:

     3.7.1 UK standard contractual clauses approved by the ICO are entered into between the Agency and the Client or relevant Associate as data exporter, and the relevant recipient of the personal data as data importer; or

     3.7.2 The recipient of the personal data has entered into a data processing agreement with the data exporter; or

     3.7.3 The recipient of the personal data is regulated within the United States of America solely by the U.S. Department of Commerce, is certified under the UK/US Privacy Shield framework, and continues to be certified for the period within which it processes the personal data; or

     3.7.4 The recipient of the personal data has entered into binding corporate rules, which are valid in respect of the processing of personal data under this agreement and have been approved by the ICO; or

     3.7.5 The transfer is to a recipient located within a jurisdiction whose law relating to the processing of personal data has been approved by the ICO (subject to any applicable restrictions).

3.8 Have in place at all times appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by processing the personal data, to prevent accidental, unauthorised or unlawful destruction, loss, alteration, or access to personal data, including as a minimum whatever security measures the Agency and the Client requires of each other and notify to that other. Examples of such measures are:

     3.8.1 The pseudonymisation and encryption of personal data;

     3.8.2 The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; and

     3.8.3 A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing;

3.9 Maintain a written record of all categories of processing activities carried out on behalf of the other party and when that other party asks, copy the record to it. The record shall contain:

     3.9.1 Name and contact details and (where applicable) those of the Client’s and Agent’s approved sub-processors and details of their respective data protection officers;

     3.9.2  The categories of personal data, data subjects and processing activities carried out on behalf of the Agency and the Client or Associates;

     3.9.3  Where applicable, transfers of personal data to a third country (i.e. non-EU Member State) or an international organisation, including identification of that third country and documentation evidencing implementation of suitable safeguards; and

     3.9.4 A general description of the technical and organisational security measures we have installed as referred in Section 56 of the Act;

3.10 When the Agency asks, give to the Agency or to the ICO, access to the Client’s employees, data processing facilities, procedures, and records to inspect and audit compliance with the Data Protection Legislation and the terms of this Agreement. The Agency and the Client agrees that each of the Agency and the Client shall (and shall ensure any sub-processor shall) give all reasonable cooperation and assistance.

3.11  Immediately tell the other party (and in any event within 24 hours) after becoming aware of any actual or suspected unlawful destruction, loss, alteration, disclosure of, or access to, personal data transmitted, stored or otherwise processed by the Agency or the Client or any sub-processor under this Agreement;

3.12     Provide reasonable assistance to each other in:

     3.12.1 Responding to data subject’s requests to exercise their rights under the Act;

     3.12.2 Responding to communications received from the ICO relating to the processing of personal data under this agreement, including notifying the other immediately of any such communication;

     3.12.3 Taking measures to address data security incidents, including, where appropriate, measures to mitigate their possible adverse effects;

     3.12.4 Promptly upon request, transfer personal data to a third party in compliance with a request from a data subject to exercise their right to data portability;

     3.12.5 Make available to other on request all information necessary to demonstrate compliance with the obligations set out in this Schedule.