Freedom of Information Act or FoIA The Freedom of Information Act 2000 and any subordinate legislation made under the Act together with any guidance or codes of practice issued by the Information Commissioner or relevant government department in relation to the legislation. G-Cloud Services The cloud services described in Framework Agreement Section 2 (Services Offered) as defined by the Service Definition, the Supplier Terms and any related Application documentation, which the Supplier must make available to CCS and Buyers and those services which are deliverable by the Supplier under the Collaboration Agreement. GDPR General Data Protection Regulation (Regulation (EU) 2016/679) Good Industry Practice Standards, practices, methods and process conforming to the Law and the exercise of that degree of skill and care, diligence, prudence and foresight which would reasonably and ordinarily be expected from a skilled and experienced person or body engaged in a similar undertaking in the same or similar circumstances. Government Procurement Card The government’s preferred method of purchasing and payment for low value goods or services. Guarantee The guarantee described in Schedule 5. Guidance Any current UK government guidance on the Public Contracts Regulations 2015. In the event of a conflict between any current UK government guidance and the Crown Commercial Service guidance, current UK government guidance will take precedence. Implementation Plan The plan with an outline of processes (including data standards for migration), costs (for example) of implementing the services which may be required as part of Onboarding. Indicative test ESI tool completed by contractors on their own behalf at the request of CCS or the Buyer (as applicable) under clause 4.6. Information Has the meaning given under section 84 of the Freedom of Information Act 2000. Information security management system The information security management system and process developed by the Supplier in accordance with clause 16.
Freedom of Information and Protection of Privacy Act Any information provided on this contract may be subject to release under the Freedom of Information and Protection of Privacy Act. The Contractor may be consulted prior to release of any information.
Data Protection Act 7.1 With respect to the parties' rights and obligations under this Contract, the parties agree that the Department is the Data Controller and that the Contractor is the Data Processor.
7.2 The Contractor shall:
7.2.1 Process the Personal Data only in accordance with instructions from the Department (which may be specific instructions or instructions of a general nature as set out in this Contract or as otherwise notified by the Department to the Contractor during the Term);
7.2.2 Process the Personal Data only to the extent, and in such manner, as is necessary for the provision of the Services or as is required by Law or any Regulatory Body;
7.2.3 The Contractor shall employ appropriate organisational, operational and technological processes and procedures to keep the Personal Data safe from unauthorised use or access, loss, destruction, theft or disclosure. The organisational, operational and technological processes and procedures adopted are required to comply with the requirements of ISO/IEC 27001 as appropriate to the services being provided to the Department;
7.2.4 Take reasonable steps to ensure the reliability of any Contractor Personnel who have access to the Personal Data;
7.2.5 Obtain prior written consent from the Department in order to transfer the Personal Data to any Sub-contractors or Affiliates for the provision of the Services;
7.2.6 Ensure that all Contractor Personnel required to access the Personal Data are informed of the confidential nature of the Personal Data and comply with the obligations set out in this clause 7;
7.2.7 Ensure that none of Contractor Personnel publish, disclose or divulge any of the Personal Data to any third party unless directed in writing to do so by the Department;
7.2.8 Notify the Department within five Working Days if it receives: a request from a Data Subject to have access to that person's Personal Data; or a complaint or request relating to the Department's obligations under the Data Protection Legislation;
7.2.9 Provide the Department with full cooperation and assistance in relation to any complaint or request made, including by: - providing the Department with full details of the complaint or request; - complying with a data access request within the relevant timescales set out in the Data Protection Legislation and in accordance with the Department's instructions; - providing the Department with any Personal Data it holds in relation to a Data Subject (within the timescales required by the Department); and - providing the Department with any information requested by the Department;
7.2.10 Permit the Department or the Department’s Representative (subject to reasonable and appropriate confidentiality undertakings), to inspect and audit the Contractor's data Processing activities (and/or those of its agents, subsidiaries and Sub-contractors) and comply with all reasonable requests or directions by the Department to enable the Department to verify and/or procure that the Contractor is in full compliance with its obligations under this Contract;
7.2.11 Provide a written description of the technical and organisational methods employed by the Contractor for processing Personal Data (within the timescales required by the Department) to be used solely for the purposes of this contract and provided that to do so would not be in breach of the Intellectual Property Rights (including Copyright) of a third party; and
7.2.12 Not process Personal Data outside the European Economic Area without the prior written consent of the Department and, where the Department consents to a transfer, to comply with: - the obligations of a Data Controller under the Eighth Data Protection Principle set out in Schedule 1 of the Data Protection Act 1998 by providing -an adequate level of protection to any Personal Data that is transferred; and - any reasonable instructions notified to it by the Department.
7.3 The Contractor shall comply at all times with the Data Protection Legislation and shall not perform its obligations under this Contract in such a way as to cause the Department to breach any of its applicable obligations under the Data Protection Legislation.
Third-Party Information; Privacy or Data Protection Laws Each Party acknowledges that it and its respective Subsidiaries may presently have and, after the Effective Time, may gain access to or possession of confidential or proprietary Information of, or personal Information relating to, Third Parties: (i) that was received under confidentiality or non-disclosure agreements entered into between such Third Parties, on the one hand, and the other Party or the other Party’s Subsidiaries, on the other hand, prior to the Effective Time or (ii) that, as between the two parties, was originally collected by the other Party or the other Party’s Subsidiaries and that may be subject to and protected by privacy, data protection or other applicable Laws. Each Party agrees that it shall hold, protect and use, and shall cause its Subsidiaries and its and their respective Representatives to hold, protect and use, in strict confidence the confidential and proprietary Information of, or personal Information relating to, Third Parties in accordance with privacy, data protection or other applicable Laws and the terms of any agreements that were either entered into before the Effective Time or affirmative commitments or representations that were made before the Effective Time by, between or among the other Party or the other Party’s Subsidiaries, on the one hand, and such Third Parties, on the other hand.
Freedom of Information and Transparency 20.1 The Recipient acknowledges that the Commissioner is subject to the provisions of the FOIA and agrees to assist and co-operate with the Commissioner (at the Recipient’s expense) where necessary to enable the Commissioner to comply with any requests received under the FOIA relating to this Agreement. This includes, but is not limited to, transferring to the Commissioner any request received by the Recipient under the FOIA relating to this Agreement as soon as practicable following receipt and in any event within three working days of receipt.
20.2 In no event shall the Recipient respond to a request under the FOIA relating to this Agreement without obtaining the prior written consent of the Commissioner.
20.3 The Recipient acknowledges that the Commissioner may be obliged to disclose information under the FOIA:
20.3.1 Without consulting the Recipient; or
20.3.2 Following consultation with the Recipient and having taken into account its views. Provided that where clause 20.3.1 applies the Commissioner shall, in accordance with the recommendations of the Secretary of State for Constitutional Affairs’ Code of Practice on the discharge of a public authorities’ functions under Part 1 of FOIA, take reasonable steps, to give the Recipient advanced notice or to draw the disclosure to the Recipient’s attention after any such disclosure.
20.4 The Recipient shall ensure it retains for disclosure all information (as defined in the FOIA) produced in the course of this Agreement or relating to this Agreement and shall allow the Commissioner to inspect such records from time to time upon request.
20.5 The Recipient acknowledges that the Commissioner is subject to certain transparency and disclosure obligations set out in the Elected Local Policing Bodies Specified Information Order 2011 (as amended) (“Transparency Obligations”)
20.6 The Recipient consents to the Commissioner publishing the contents of this Agreement and information regarding any tender process related to the Purpose of the Agreement to enable the Commissioner to comply with their Transparency Obligations.
20.7 The Recipient acknowledges that:
20.7.1 The Commissioner shall be responsible for determining, at their absolute discretion, whether any information is exempt from disclosure or should be disclosed pursuant to the FOIA and/or the Transparency Obligations and to what extent any information disclosed shall be redacted; and
20.7.2 Any lists or schedules provided by the Recipient outlining confidential information are of an indicative value only and that the Commissioner may be obliged to disclose confidential information in accordance with Clause 20.3 and/or Clause 20.5.