Common use of Data Processor Obligations Clause in Contracts

Data Processor Obligations. 3.1. In relation to any Personal Data processed by or on behalf of Global in the provision of the Global Services, Global shall: (a) only process the Personal Data in order to provide the Global Services and shall act only in accordance with the Agreement, this Addendum and on the instruction of Advertiser ("Processing Instructions" and as may be further defined in Exhibit A). In the event that Data Protection Laws require Global to process Personal Data other than pursuant to Advertiser's instruction, Global will notify Advertiser before processing such Personal Data (unless prohibited from so doing by Data Protection Laws on important grounds of public interest); (b) as soon as reasonably practicable inform Advertiser if, in its opinion, an instruction of Advertiser infringes Data Protection Laws; (c) taking into account the nature of and risks associated with the type of Personal Data collected or used in connection with the Global Services, implement and maintain appropriate technical and organisational measures in relation to the processing of Personal Data by Global: (i) such that the processing will meet the requirements of Data Protection Laws and ensure the protection of the rights of Data Subjects; (ii) so as to ensure a level of security in respect of Personal Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed; and (iii) without prejudice to clause 3.1(h), insofar as is possible, to assist Advertiser in the fulfilment of Advertiser's obligations to respond to Data Subject Requests relating to Personal Data. (d) not engage Sub-Processors in respect of the Global Services without Advertiser's prior written consent. Global shall remain fully liable to Advertiser for the performance of a Sub-Processor's obligations; (e) without prejudice to any other provision of this Addendum, ensure that Global personnel processing Personal Data are reliable and have received adequate training on compliance with this Addendum and the Data Protection Laws applicable to the processing; (f) ensure that all Sub-Processors and Global personnel processing Personal Data are subject to a binding written contractual obligation with Global to keep the Personal Data confidential (except where disclosure is required in accordance with law, in which case Global shall, where practicable and not prohibited by law, notify Advertiser of any such requirement before such disclosure); (g) provide such information, co-operation and other assistance as Advertiser requires (taking into account the nature of processing and the information available to Global) to Advertiser in ensuring compliance with Advertiser's obligations under Data Protection Laws, including with respect to: (i) security of processing; (ii) data impact assessments (as defined by Data Protection Laws); (iii) (any remedial action and/or notifications to be taken in response to any Personal Data Breach and/or Complaint, including (subject in each case to Advertiser's prior written authorisation) regarding any notification of the Personal Data Breach to Supervisory Authorities and/or communication to any affected Data Subjects. (h) In relation to requests from Data Subjects: (iv) refer all Data Subject requests for notification, erasure or other requests under Data Protection Laws ("Data Subject Requests") it receives to Advertiser as soon as reasonably practicable; (v) provide such information and cooperation and take such action as Advertiser requests in relation to a Data Subject Request, as soon as reasonably practicable; and (vi) not respond to any Data Subject Request or Complaint without Advertiser's prior written approval. (i) In respect of any Personal Data Breach: (vii) notify Advertiser of the Personal Data Breach without undue delay; (viii) provide Advertiser without undue delay with such details as Advertiser reasonably requires regarding: (ix) the nature and cause or possible cause of the Personal Data Breach, including the categories and approximate numbers of Data Subjects and Personal Data records concerned; (x) any investigations into such Personal Data Breach; (xi) the likely consequences of the Personal Data Breach and the unauthorised recipients of the Personal Data; and (xii) any measures taken, or that Global recommends, to address the Personal Data Breach, including to mitigate its possible adverse effects.

Data Processor Obligations. 3.1. In relation to any Personal Data processed by or on behalf of Global in the provision of the Global Services, Global shall: (a) only process the Personal Data in order to provide the Global Services and shall act only in accordance with the Agreement, this Addendum and on the instruction of Advertiser ("Processing Instructions" and as may be further defined in Exhibit A). In the event that Data Protection Laws require Global to process Personal Data other than pursuant to Advertiser's instruction, Global will notify Advertiser before processing such Personal Data (unless prohibited from so doing by Data Protection Laws on important grounds of public interest); (b) as soon as reasonably practicable inform Advertiser if, in its opinion, an instruction of Advertiser infringes Data Protection Laws; (c) taking into account the nature of and risks associated with the type of Personal Data collected or used in connection with the Global Services, implement and maintain appropriate technical and organisational measures in relation to the processing of Personal Data by Global: (i) such that the processing will meet the requirements of Data Protection Laws and ensure the protection of the rights of Data Subjects; (ii) so as to ensure a level of security in respect of Personal Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed; and (iii) without prejudice to clause 3.1(h), insofar as is possible, to assist Advertiser in the fulfilment of Advertiser's obligations to respond to Data Subject Requests relating to Personal Data. (d) not engage Sub-Processors in respect of the Global Services without Advertiser's prior written consent. Global shall remain fully liable to Advertiser for the performance of a Sub-Processor's obligations; (e) without prejudice to any other provision of this Addendum, ensure that Global personnel processing Personal Data are reliable and have received adequate training on compliance with this Addendum and the Data Protection Laws applicable to the processing; (f) ensure that all Sub-Processors and Global personnel processing Personal Data are subject to a binding written contractual obligation with Global to keep the Personal Data confidential (except where disclosure is required in accordance with law, in which case Global shall, where practicable and not prohibited by law, notify Advertiser of any such requirement before such disclosure); (g) provide such information, co-operation and other assistance as Advertiser requires (taking into account the nature of processing and the information available to Global) to Advertiser in ensuring compliance with Advertiser's obligations under Data Protection Laws, including with respect to: (i) security of processing; (ii) data impact assessments (as defined by Data Protection Laws); (iii) (any remedial action and/or notifications to be taken in response to any Personal Data Breach and/or Complaint, including (subject in each case to Advertiser's prior written authorisation) regarding any notification of the Personal Data Breach to Supervisory Authorities and/or communication to any affected Data Subjects. (h) In relation to requests from Data Subjects: (ivi) refer all Data Subject requests for notification, erasure or other requests under Data Protection Laws ("Data Subject Requests") it receives to Advertiser as soon as reasonably practicable; (vii) provide such information and cooperation and take such action as Advertiser requests in relation to a Data Subject Request, as soon as reasonably practicable; and (viiii) not respond to any Data Subject Request or Complaint without Advertiser's prior written approval. (i) In respect of any Personal Data Breach: (viii) notify Advertiser of the Personal Data Breach without undue delay; (viiiii) provide Advertiser without undue delay with such details as Advertiser reasonably requires regarding: (ixiii) the nature and cause or possible cause of the Personal Data Breach, including the categories and approximate numbers of Data Subjects and Personal Data records concerned; (xiv) any investigations into such Personal Data Breach; (xiv) the likely consequences of the Personal Data Breach and the unauthorised recipients of the Personal Data; and (xiivi) any measures taken, or that Global recommends, to address the Personal Data Breach, including to mitigate its possible adverse effects. (j) promptly inform Advertiser if it receives a Complaint and provide Advertiser with full details of such Complaint. (k) without delay, at Advertiser's written request, either securely delete or securely return all the Personal Data to Advertiser in such form as Advertiser reasonably requests once processing by Global of any Personal Data is no longer required for the purpose of Global's performance of its relevant obligations under this Addendum and the Agreement, and securely delete existing copies (unless storage of any data is required by law and, if so, Global shall inform Advertiser of any such requirement).