Common use of Rights of the Data Subject Clause in Contracts

Rights of the Data Subject. a. The Supplier shall notify the other Party within three (3) working days if it receives: (a) from a Data Subject an actual or purported request exercising a Data Subject’s rights (whether by the Data Subject or on its behalf) in accordance with Applicable Laws, including any one of: a request to access their Personal Data, rectify any inaccurate Personal data, have Personal Data erased, restrict the Processing of their Personal Data, obtain a portable copy of Personal Data or to transfer such a copy to a third party; an objection to any Processing of their Personal Data, or any other request, complaint or communication relating to obligations under Applicable Laws from a Data Subject (a "Data Subject Request"); or (b) requests, correspondence or communications (whether written or verbal) from a Regulator ("Regulator Correspondence"). b. The Supplier shall, without undue delay, provide the Company with full details of any Data Subject Request or Regulator Correspondence and reasonable details of the circumstances giving rise to it, including details of the relevant Personal Data or other information reasonably requested by the Company, which the Company shall be permitted to disclose to its professional advisors and applicable Regulators. c. The Supplier shall provide all reasonable co-operation to allow the Company to investigate any such Data Subject Request or Regulator Correspondence and, taking into consideration the nature of the Processing, the Supplier shall assist the Company by appropriate technical and organisation measures, insofar as is possible, to enable the Company to fulfil its obligations to respond to such Data Subject Request or Regulator Correspondence. This should be coordinated with the Supplier’s Data Protection Officer. d. The Supplier shall not fulfil or respond to any Data Subject Request without first notifying the other Party. e. The Supplier shall, and ensure that its authorised Sub-Processors shall, have in place appropriate technical and organisational measures to enable: i. the proper rectification of inaccurate Personal Data either (i) in accordance with such a request from the Data Subject; or (ii) the other Party, duly authorised; ii. the complete erasure, to the extent required by law, of a specified Data Subject’s Personal Data; and iii. the ability for individual Data Subject’s Personal Data to be transported to the Data Subject or a third party, in a recognisable and commonly used format. f. The actions set out under 5.6 (e) (i) - (iii) would only be undertaken by the Supplier or its Sub-Processors after specific written requests from the Company.

Rights of the Data Subject. a. The Supplier shall notify the other Party within three (3) working days if it receives: (a) from a Data Subject an actual or purported request exercising a Data Subject’s rights (whether by the Data Subject or on its behalf) in accordance with Applicable Laws, including any one of: a request to access their Personal Data, rectify any inaccurate Personal data, have Personal Data erased, restrict the Processing of their Personal Data, obtain a portable copy of Personal Data or to transfer such a copy to a third party; an objection to any Processing of their Personal Data, or any other request, complaint or communication relating to obligations under Applicable Laws from a Data Subject (a "Data Subject Request"); or (b) requests, Version: 1.00 correspondence or communications (whether written or verbal) from a Regulator ("Regulator Correspondence"). b. The Supplier shall, without undue delay, provide the Company with full details of any Data Subject Request or Regulator Correspondence and reasonable details of the circumstances giving rise to it, including details of the relevant Personal Data or other information reasonably requested by the Company, which the Company shall be permitted to disclose to its professional advisors and applicable Regulators. c. The Supplier shall provide all reasonable co-operation to allow the Company to investigate any such Data Subject Request or Regulator Correspondence and, taking into consideration the nature of the Processing, the Supplier shall assist the Company by appropriate technical and organisation measures, insofar as is possible, to enable the Company to fulfil its obligations to respond to such Data Subject Request or Regulator Correspondence. This should be coordinated with the Supplier’s Data Protection Officer. d. The Supplier shall not fulfil or respond to any Data Subject Request without first notifying the other Party. e. The Supplier shall, and ensure that its authorised Sub-Processors shall, have in place appropriate technical and organisational measures to enable: i. the proper rectification of inaccurate Personal Data either (i) in accordance with such a request from the Data Subject; or (ii) the other Party, duly authorised; ii. the complete erasure, to the extent required by law, of a specified Data Subject’s Personal Data; and iii. the ability for individual Data Subject’s Personal Data to be transported to the Data Subject or a third party, in a recognisable and commonly used format. f. The actions set out under 5.6 (e) (i) - (iii) would only be undertaken by the Supplier or its Sub-Processors after specific written requests from the Company.

Rights of the Data Subject. a. The Supplier shall notify the other Party within three (3) working days if it receives: (a) from a Data Subject an actual or purported request exercising a Data Subject’s rights (whether by the Data Subject or on its behalf) in accordance with Applicable Laws, including any one of: a request to access their Personal Data, rectify any inaccurate Personal data, have Personal Data erased, restrict the Processing of their Personal Data, obtain a portable copy of Personal Data or to transfer such a copy to a third party; an objection to any Processing of their Personal Data, or any other request, complaint or communication relating to obligations under Applicable Laws from a Data Subject (a "Data Subject Request"); or (b) requests, correspondence or communications (whether written or verbal) from a Regulator ("Regulator Correspondence"). b. The Supplier shall, without undue delay, provide the Company with full details of any Data Subject Request or Regulator Correspondence and reasonable details of the circumstances giving rise to it, including details of the relevant Personal Data or other information reasonably requested by the Company, which the Company shall be permitted to disclose to its professional advisors and applicable Regulators. c. The Supplier shall provide all reasonable co-operation to allow the Company to investigate any such Data Subject Request or Regulator Correspondence and, taking into consideration the nature of the Processing, the Supplier shall assist the Company by appropriate technical and organisation measures, insofar as is possible, to enable the Company to fulfil its obligations to respond to such Data Subject Request or Regulator Correspondence. This should be coordinated with the Supplier’s Data Protection Officer. d. The Supplier shall not fulfil or respond to any Data Subject Request without first notifying the other Party. e. The Supplier shall, and ensure that its authorised Sub-Processors shall, have in place appropriate technical and organisational measures to enable: i. the proper rectification of inaccurate Personal Data either (i) in accordance with such a request from the Data Subject; or (ii) the other Party, duly authorised; ii. the complete erasure, to the extent required by law, of a specified Data Subject’s Personal Data; andand Version: 1.00 iii. the ability for individual Data Subject’s Personal Data to be transported to the Data Subject or a third party, in a recognisable and commonly used format. f. The actions set out under 5.6 (e) (i) - (iii) would only be undertaken by the Supplier or its Sub-Processors after specific written requests from the Company.

Rights of the Data Subject. a. The Supplier shall notify the other Party within three (3) working days if it receives: : (a) from a Data Subject an actual or purported request exercising a Data Subject’s rights (whether by the Data Subject or on its behalf) in accordance with Applicable Laws, including any one of: a request to access their Personal Data, rectify any inaccurate Personal data, have Personal Data erased, restrict the Processing of their Personal Data, obtain a portable copy of Personal Data or to transfer such a copy to a third party; an objection to any Processing of their Personal Data, or any other request, complaint or communication relating to obligations under Applicable Laws from a Data Subject (a "Data Subject Request"); or (b) requests, correspondence or communications (whether written or verbal) from a Regulator ("Regulator Correspondence"). b. The Supplier shall, without undue delay, provide the Company with full details of any Data Subject Request or Regulator Correspondence and reasonable details of the circumstances giving rise to it, including details of the relevant Personal Data or other information reasonably requested by the Company, which the Company shall be permitted to disclose to its professional advisors and applicable Regulators. c. The Supplier shall provide all reasonable co-operation to allow the Company to investigate any such Data Subject Request or Regulator Correspondence and, taking into consideration the nature of the Processing, the Supplier shall assist the Company by appropriate technical and organisation measures, insofar as is possible, to enable the Company to fulfil its obligations to respond to such Data Subject Request or Regulator Correspondence. This should be coordinated with the Supplier’s Data Protection Officer. d. The Supplier shall not fulfil or respond to any Data Subject Request without first notifying the other Party. e. The Supplier shall, and ensure that its authorised Sub-Processors shall, have in place appropriate technical and organisational measures to enable: i. the proper rectification of inaccurate Personal Data either (i) in accordance with such a request from the Data Subject; or (ii) the other Party, duly authorised; ii. the complete erasure, to the extent required by law, of a specified Data Subject’s Personal Data; and iii. the ability for individual Data Subject’s Personal Data to be transported to the Data Subject or a third party, in a recognisable and commonly used format. f. The actions set out under 5.6 (e) (i) - (iii) would only be undertaken by the Supplier or its Sub-Processors after specific written requests from the Company.