Common use of Independent Controllers of Personal Data Clause in Contracts

Independent Controllers of Personal Data. The Party acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of Buyer (excluding the Supplier Personnel) engaged in the performance of the Buyer’s duties under the Buyer Agreement) for which Buyer is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that the Buyer cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by the Buyer] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include employment Processing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.]

Independent Controllers of Personal Data. The Party Parties acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of Buyer National Highways (excluding the Supplier Personnel) engaged in the performance of the Buyer’s National Highways’ duties under the Buyer AgreementContract) for which Buyer National Highways is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that the Buyer National Highways cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by the BuyerNational Highways] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include include: employment Processingprocessing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include include: name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain were geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisation:

Independent Controllers of Personal Data. The Party Parties acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of the Buyer (excluding the Supplier Personnel) engaged in the performance of the Buyer’s duties under the Buyer Framework Agreement) for which the Buyer is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that the Buyer cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by the Buyer] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include include: employment Processingprocessing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include include: name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workersworkers), customers/ customers / clients, Supplierssuppliers, patients, students / pupils, members of the public, users of a particular website etc.]] International transfers and legal gateway [Explain where geographically personal data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract] Plan for return and destruction of the data once the Processing is complete [Describe how long the data will be retained for, how it will be returned or destroyed] Annex 2 - Joint Controller Agreement Joint Controller Status and Allocation of Responsibilities

Independent Controllers of Personal Data. The Party acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation Error! Reference source not found. in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of Buyer (excluding the Supplier Personnel) engaged in the performance of the Buyer’s duties under the Buyer Agreement) for which Buyer is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that the Buyer cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by the Buyer] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include employment Processing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [explain where geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g., adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract].

Independent Controllers of Personal Data. The Party Parties acknowledge that they are Independent Controllers for the purposes of the Data Protection Legislation in respect of: ● Business contact details of Supplier Personnel for which the Supplier is the Controller, ● Business contact details of any directors, officers, employees, agents, consultants and contractors of Buyer National Highways (excluding the Supplier Personnel) engaged in the performance of the Buyer’s National Highways’ duties under the Buyer AgreementContract) for which Buyer National Highways is the Controller, ● [Insert the scope of other Personal Data provided by one Party who is Controller to the other Party who will separately determine the nature and purposes of its Processing the Personal Data on receipt e.g. where (1) the Supplier has professional or regulatory obligations in respect of Personal Data received, (2) a standardised service is such that the Buyer National Highways cannot dictate the way in which Personal Data is processed by the Supplier, or (3) where the Supplier comes to the transaction with Personal Data for which it is already Controller for use by the BuyerNational Highways] [Guidance where multiple relationships have been identified above, please address the below rows in the table for in respect of each relationship identified] Duration of the Processing [Clearly set out the duration of the Processing including dates] Nature and purposes of the Processing [Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the Processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc. The purpose might include include: employment Processingprocessing, statutory obligation, recruitment assessment etc.] Type of Personal Data [Examples here include include: name, address, date of birth, NI number, telephone number, pay, images, biometric data etc.] Categories of Data Subject [Examples include: Staff (including volunteers, agents, and temporary Workers), customers/ clients, Suppliers, patients, students / pupils, members of the public, users of a particular website etc.] International transfers and legal gateway [Explain were geographically Personal Data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract]. Plan for return and destruction of the data once the Processing is complete UNLESS requirement under domestic Law to preserve that type of data [Describe how long the data will be retained for, how it be returned or destroyed] When delivering the services subject to the SEDPS, your organisation will need to deliver against the following SEDPS Social Value Objectives: