Organisational Data Protection Measures
1. The Data Processor shall ensure that, in respect of all Personal Data it receives from
or processes on behalf of the Data Controller, it maintains security measures to a
standard appropriate to:
1.1 the harm that might result from unlawful or unauthorised processing or
accidental loss, damage, or destruction of the Personal Data; and
1.2 the nature of the Personal Data.
2. In particular, the Data Processor shall:
2.1 have in place, and comply with, a security policy which:
2.1.1 defines security needs based on a risk assessment;
2.1.2 allocates responsibility for implementing the policy to a specific individual
(such as the Data Processor’s Data Protection Officer) or personnel;
2.1.3 is provided to the Data Controller on or before the commencement of
this Agreement;
2.1.4 is disseminated to all relevant staff; and
2.1.5 provides a mechanism for feedback and review.
2.2 ensure that appropriate security safeguards and virus protection are in place to
protect the hardware and software which is used in processing the Personal
Data in accordance with best industry practice;
2.3 prevent unauthorised access to the Personal Data;
2.4 protect the Personal Data using pseudonymisation, where it is practical to do
so;
2.5 ensure that its storage of Personal Data conforms with best industry practice
such that the media on which Personal Data is recorded (including paper
records and records stored electronically) are stored in secure locations and
access by personnel to Personal Data is strictly monitored and controlled;
2.6 have secure methods in place for the transfer of Personal Data whether in
physical form (for example, by using couriers rather than post) or electronic form
(for example, by using encryption);
2.7 password protect all computers and other devices on which Personal Data is
stored, ensuring that all passwords are secure, and that passwords are not
shared under any circumstances;
2.8 not allow the storage of the Personal Data on any mobile devices such as
laptops or tablets unless such devices are kept on its premises at all times;
2.9 take reasonable steps to ensure the reliability of personnel who have access to
the Personal Data;
2.10 have in place methods for detecting and dealing with breaches of security
(including loss, damage, or destruction of Personal Data) including:
2.10.1 the ability to identify which individuals have worked with specific
Personal Data;
2.10.2 having a proper procedure in place for investigating and remedying
breaches of the GDPR; and
2.10.3 notifying the Data Controller as soon as any such security breach
occurs.
2.11 have a secure procedure for backing up all electronic Personal Data and storing
back-ups separately from originals;
2.12 have a secure method of disposal of unwanted Personal Data including for
back-ups, disks, print-outs, and redundant equipment; and
2.13 adopt such organisational, operational, and technological processes and
procedures as are required to comply with the requirements of ISO/IEC
27001:2013, as appropriate to the Services provided to the Data Controller.