DATED20[ ]
(1)Health & Care Professions Council
and
(2)[insert full name of data processor]
AGREEMENT
in relation to Data Processing
5210829.01
DATA PROCESSING AGREEMENT
BETWEEN:
(1)Health & Care Professions Council, a statutory body operating under the Health and Social Work Professions Order 2001 whose principal place of business is at Park House, 184 Kennington Park Road, London, SE11 4BU(the Controller); and
(2)[insert name of data processor][a company limited by shares and incorporated in [England] under Company Number [insert company number] whose registered office is at [insert address]] OR [, an individual whose principal place of business is at [insert address]] OR [, a partnership, the partners of which are specified in the Schedule and whose principle place of business is at [insert address]] (the Processor).
RECITALS:
(A)The Controller is the Data Controller (as hereinafter defined) of various Personal Data (as hereinafter defined).
(B)The Processor is providing services to the Controller which require it to Process (as hereinafter defined) Personal Data of which the Controller is the Data Controller.
(C)[This Agreement sets out the services that are to be provided and the terms on which the Processing will be undertaken]OR [The terms on which the services are to be provided are set out in a separate agreement and this Agreement sets out the terms on which the Processor shall Process the relevant Personal Data].
NOW IT IS AGREED as follows:
1Definitions and interpretation
1.1In this Agreement, the following words and expressions shall have the following meanings unless the context otherwise requires:
1998 Act
/means the Data Protection Act 1998;
Bank Holiday / means any day designated as a public holiday in England by the Government of the United KingdomData Controller / shall have the same meaning as in the 1998 Act;
Data Processor
/ shall have the same meaning as in the 1998 Act;Data Subject
/shall have the same meaning as in the 1998 Act;
[Fee
/[£1]];
Good Industry Practice
/means the exercise of the degree of skill, due diligence, prudence and foresight that would reasonably and ordinarily be expected from a skilled and experienced person engaged in the provision of the Processing of Personal Data and the Services;
HCPC Data
/means Personal Data of which the Controller is the Data Controller or Personal Data collected by the Processor in performing the Services;
Intellectual Property / means all industrial and intellectual property rights including without limitation patents trade marks and/or service marks (whether registered or unregistered) registered designs unregistered designs copyright and database right and rights of a similar nature by whatever name they are known in any country of the world together with any applications for any of the foregoing in any part of the world and the copyright in all drawings plans specifications designs and computer software and all Know-how and confidential information;Know-how / means all information including that comprised in or derived from date disks tapes manuals source codes flow-charts catalogues and instructions;
Personal Data
/shall have the same meaning as in the 1998 Act;
Processing
/has the meaning attributed to it in the 1998 Act and ‘process’ and ‘processed’ shall be construed accordingly;
Services
/means the services to be provided by the Processor to the Controller as set out in Clause 2.2 below;
Statement
/means a statement which sets out the purposes for which any Personal Data shall be processed by the Data Controller;
Working Day / means any weekday excluding any Bank Holiday in England and Wales.1.2All references to a statutory provision shall be construed as including references to:
1.2.1any statutory modification, consolidation or re-enactment;
1.2.2all statutory instruments or orders made pursuant to it; and
1.2.3any statutory provision of which it is a modification, consolidation or re-enactment.
1.3Except where the context otherwise requires:
1.3.1words denoting the singular include the plural and vice versa;
1.3.2words denoting any gender include all genders;
1.3.3words denoting persons including firms and corporations and vice versa.
1.4Unless otherwise stated, a reference to a clause, sub-clause or Schedule is a reference to a clause or a sub-clause of, or a Schedule to, this Agreement.
1.5Clause headings are for ease of reference only and do not affect the construction of this Agreement.
1.6Unless otherwise stated references to either party shall be deemed to include their respective permitted assignees and the successors in title to substantially the whole of their respective undertakings.
1.7[The schedules form part of the operative provisions of this Agreement and reference to this Agreement shall, unless the context otherwise requires, include references to the schedules.]
2The Services
2.1The Processor agrees to carry out the Services in accordance with the terms set out in this Agreement.
2.2[The Services are:
2.2.1[insert detail of first service];
2.2.2[insert detail of second service];
2.2.3[etc];]
[The Services shall be those that are set out in the Agreement between the Controller and the Processor dated [insert date] in relation to [insert general description of the matter].
3Data protection obligations
3.1The HCPC Data shall be Processed by the Processor to enable the Processor to provide the Services. In such circumstances the Processor shall:
3.1.1comply with the requirements of the 1998 Act and any equivalent applicable legislation in any other country and in accordance with Good Industry Practice. In particular, the Processor shall comply with the provisions of the 1998 Act in respect of [the Services] [the Processing of the HCPC Data] as if [he] [it] were a Data Controller;
3.1.2collect, compile, manipulate and store or otherwise process the HCPC Data only as instructed in writing in advance by the Controller. The Processor shall not carry out any other processing, use or disclosure of the Personal Data; and
3.1.3where and when requested by the Controller, provide at its cost a copy of all or any part of the HCPC Data to the Controller.
3.2The Controller may request by written notice that any specific item of data, including but not limited to Personal Data, contained in the HCPC Data be amended or deleted.
3.3The Processor shall in particular but without limiting its obligations under Clause 3.1 above:
3.3.1maintain comprehensive registrations or notifications under the 1998 Act or equivalent legislation in any other country in relation to the processing of Personal Dataprocessed by the Processor, including the HCPC Data if required by such legislation;
3.3.2be aware at all times of the registrable particulars of the Controller under the 1998 Act, and ensure that it does not use, disclose or Process the HCPC Data in any way that is outside the scope of those particulars, provided that the Controller shall notify the Processor of its notifiable particulars or its notification number, which is Z6621691, and any alterations to its registrable particulars;
3.3.3keep anyHCPC Datawhich it Processes fully up to date on a timely basis at all times during the continuance of this Agreement;
3.3.4at all times have in place appropriate technical and organisational security measures, including database software and equipment, governing the Processing of the HCPC Data and any employees involved in such Processing, and provide details of these measures to the Controller in writing within 10 days of a request in writing from the Controller during the Term; and
3.3.5notify the Controller immediately if it receives any notice of non-compliance with, or a request for information under the 1998 Act or any equivalent legislation in any other country in respect of both the HCPC Data and any other Personal Data which it may Process.
3.4The Controller may, at its discretion and on reasonable written notice, require access to the Processor’s premises and the provision of sufficient relevant information in order to assess the adequacy of the Processor’s security measures.
3.5If any of the HCPC Datathat are in the sole possession of the Processor are either lost or sufficiently degraded to be unusable, the Processor shall provide replacement and or corrected data within three Working Days.
3.6The Processor may not, in any circumstances, transfer any of the HCPC Data to any country or territory outside the European Economic Area without the Controller’s prior written consent, which may be withheld in its absolute discretion.
3.7[The Processor shall not collect any Personal Data on behalf of the Controller] OR [All Data Subjects whose Personal Data are collected by the Processor on behalf of the Controller shall be issued with aStatementby the Processor.]
4Confidentiality
4.1The parties agree to treat as secret and confidential and not at any time for any reason to disclose or permit to be disclosed to any person or persons or otherwise make use of or permit to be made use of any of the HCPC Data or any information relating to the business affairs or finances of the other party where knowledge or details of the information was received as a result of this Agreement.
4.2The obligations of confidence referred to in Clause 4.1 shall not apply to any confidential information received by one of the parties under this Agreement which:
4.2.1is in the possession of and is at the free disposal of that party or is published or is otherwise in the public domain prior to the receipt of such information by that party;
4.2.2is or becomes publicly available on a non-confidential basis through no fault or negligence of that party; or
4.2.3is received in good faith by that party from a third party who on reasonable enquiry by that party has no obligations of confidence to the party in respect of it and imposes no obligations of confidence upon that party.
4.3Should any confidential information received be subject of a request under the Freedom of Information Act 2000, the Controller will consider any confidentiality provision prior to making any disclosure.However, the Controller cannot make any guarantee that confidential information will not be disclosed in response to such a request.
5[Fees
5.1In consideration of the provision of the Services the Controller shall pay the Processor the Fee.]
6Publicity
6.1Any announcements relating to this Agreement shall be agreed by both parties in writing prior to being released.
7Intellectual Property Rights
7.1This Agreement does not grant either party to use any rights in any form of Intellectual Property owned or licensed by the other.
8Ownership of personal data
8.1The Personal Data and any rights subsisting in them, including without limitation any database rights, are and shall remain at all times the property of the Controller, and the Processor assigns to the Controller any copyright in the Personal Data conferred under the laws of the United Kingdom and all other countries of the world that will be created by the Processor during the term of this Agreement for the full term during which those rights and any renewals or extensions subsist.
8.2The Controller grants the Processor for the term of this Agreement a non-exclusive royalty-free licence of the rights set out in Clause 8.1 as necessary solely for the purposes of this Agreement. The Processor undertakes not to use the rights for any other purpose.
9Indemnity
9.1The Processor agrees and undertakes to indemnify the Controller and hold the Controller harmless against all and any costs, liabilities and losses whatsoever incurred by the Controller arising out of any action or inaction of the Processor that results in the Controller being in breach of any of its obligations or duties under the 1998 Act or equivalent applicable legislation in any other country.
10Warranties
10.1The Processor warrants that:
10.1.1it has maintained and will continue to maintain comprehensive registrations under the 1998 Act or equivalent legislation in any other country in relation to the Processing of the Personal Data by the Processor;
10.1.2it has not received any notice of non-compliance with, or a request for information under the 1998 Act;
10.1.3it has in place adequate technical and organisational security measures, including database software and equipment, governing the Processing of the Personal Data and any employees involved in such Processing;
10.1.4it shall carry out the Services and the Processing of the HCPC Datawith due skill and care.
11Termination
11.1Either party may, without prejudice to its other remedies, terminate this Agreement,unless terminated earlier pursuant to Clause 11.2:
11.1.1[immediately on the termination of any separate agreement under which the Services are provided;]
11.1.2immediately once the Services have been completed to the satisfaction of the Controller, such satisfaction to be communicated to the Processor in writing;
11.1.3on one months’ written notice.
11.2Either Party may without prejudice to any other remedies terminate this Agreement forthwith by notice in writing to the other if that party:
11.2.1commits a material breach of this Agreement and fails to remedy the breach, if capable of remedy, within 30 days of being required to do so by written notice; or
11.2.2commits repeated breaches of this Agreement; or
11.2.3is unable to pay its debts, enters into compulsory or voluntary liquidation (other than to effect a reconstruction or amalgamation where the company resulting from the reconstruction or amalgamation, if a different legal entity, agrees to be bound by and assumes the obligations of the Processor under this Agreement), compounds with or convenes a meeting of its creditors, has a receiver or manager or an administrator appointed of its assets, ceases for any reason to carry on business or takes or suffers any similar action that in the opinion of the Controller means that the Processor may be unable to pay its debts.
11.3Upon the termination of this Agreement for whatever reason, the Processor shall, unless notified otherwise by the Controller or required by law, immediately cease all Processing of the Personal Data and, as requested by the Controller, destroy or return to the Controller on suitable media all copies of the Personal Data held in whatever form by the Processor or any sub-contractor.
12Sub-contracting
12.1The Processor may not sub-contract the performance of any obligation to which it is subject pursuant to this Agreement without the prior written consent of the Controller and without acting in accordance with the provisions of this Clause 12.
12.2The Processor shall notify the Controller of the identity of any proposed sub-contractor and provide written evidence that the proposed sub-contractor is capable of complying with all the obligations of the Processor set out in this Agreement.
12.3The Processor shall enter into a written agreement, a copy of which shall be provided to the Controller before it is entered into, with any sub-contractor on terms no less onerous than those set out in this Agreement.
12.4Any agreement with a sub-contractor must terminate automatically on termination of this Agreement.
13Force Majeure
13.1Neither party shall be liable to the other or be deemed to be in breach of this Agreement by reason of any delay in performing, or any failure to perform, any of its obligations in relation to this Agreement, if the delay or failure was due to any cause beyond that party’s reasonable control. Without limiting the foregoing, the following shall be regarded as causes beyond a party’s reasonable control:
13.1.1Act of God, explosion, flood, tempest, fire or accident;
13.1.2war or threat of war, sabotage, insurrection, civil disturbance or requisition;
13.1.3acts, restrictions, regulations, byelaws, prohibitions or measures of any kind on the part of any governmental, parliamentary or local authority;
13.1.4power failure or breakdown in machinery.
13.2Subject to Clause 13.3 below, should any event of force majeure continue for longer than thirty (30) days, this Agreement shall automatically terminate.
13.3The Controller may by written notice within the period specified in Clause 13.2 above extend such period for up to three (3) months at its sole discretion.
14Waiver
14.1No waiver by either party of any breach of the terms of this Agreement by the other shall be considered as a waiver of any subsequent breach of the same or any other provision.
15Severability
15.1If any provision of this Agreement is held by a court or other competent authority to be invalid or unenforceable in whole or in part the validity of the other provisions of this Agreement and the remainder of the provision in question shall not be affected.
16Notice
16.1Notices shall be in writing and shall be sent to the other Party marked for the attention of the person at the address set out below. Correctly addressed notices sent by first-class mail shall be deemed to have been delivered three Working Days after posting and correctly directed facsimile and email transmissions shall be deemed to have been delivered at 9am on the next Working Day following transmission provided that they are confirmed by a confirmation copy being sent within one Working Day by first-class mail.
16.2Notice by telephone must be confirmed by the party giving notice in writing within 24 hours of the telephone call.
16.3No form of electronic communication other those specified in this Agreement may be used for the purposes of transmitting any form of notice under this Agreement.
16.4If to the Controller notices shall be sent to:
16.4.1Name:[insert];
16.4.2Address: [insert];
16.4.3Facsimile Number: [insert];
16.4.4Telephone Number: [insert].
16.5If to the Processor notices shall be sent to:
16.5.1Name:[insert];
16.5.2Address: [insert];
16.5.3Facsimile Number: [insert];
16.5.4Telephone Number: [insert].
17Third Parties
17.1[The parties confirm their intent not to confer any rights on any third parties by virtue of this Agreement and accordingly the Contracts (Rights of Third parties) Act 1999 shall not apply to this Agreement.]
18Whole Agreement
18.1Each party acknowledges that this Agreement contains the whole agreement between parties and that it has not relied upon any oral or written representation made to it by the other.
19Assignment
19.1This Agreement is personal as between the parties and the Processor can only assign the benefit of this Agreement with the Controller’s prior written consent.
20Relationship
20.1Nothing in this Agreement and no action taken by the parties pursuant to this Agreement shall constitute, or be deemed to constitute, the parties a partnership, association, joint venture or other co-operative entity.
21Governing Law and Jurisdiction
21.1This Agreement and any dispute, controversy, proceedings or claim of whatever nature arising out of or in any way relating to this Agreement or its formation, shall be governed by and construed in accordance with English law.
21.2The parties irrevocably agree that the courts of England shall have exclusive jurisdiction to hear and decide any suit, action or proceedings, and/or to settle any disputes, that may arise out of or in connection with this Agreement and, for these purposes, irrevocably submit to the exclusive jurisdiction of the courts of England and Wales.