Curriculum Vitae data – qualifications and experience, leisure, etc. The professional associations have partnered with Simon Morrissey, Lewis Silkin`s specialist data protection lawyer, to design the clause to be used as an additional variation for clients and agencies. 8. The data protection impact analysis and the data protection subcontractor provide the company with appropriate support for all data protection impact assessments and prior consultations with supervisory authorities or other data protection authorities; that the company considers reasonably necessary in accordance with section 35 or 36 of the RGPD or equivalent provisions of another data protection law, in any case only with respect to the processing of the company`s personal data by contract processors and taking into account the nature of the processing and information available to processors. A subcontractor cannot support the services of a subprocessor without the express or written prior written permission of the processor. When authorization is granted, the subcontractor must enter into a contract with the subcontractor. The contractual terms of Article 28, paragraph 3, must provide a level of protection for personal data equivalent to that of the contract between the processing manager and the subcontractor. Transformers are responsible for processing compliance with the subprocessings they use. All personal data of the applicant provided by the Agency to the client is processed by the client in accordance with the following provisions.

The Institute of Practitioners in Advertising (IPA) and the Incorporated Society of British Advertisers (ISBA) have created a template clause that will be used in client agency contracts to ensure that data protection processes comply with the General Data Protection Regulations (GDPR). We appreciate the practical reality that it may not be possible to delete data from backups or archives at the end of a contract. If appropriate security measures are taken, such as data directly exceeding usage. B it may be acceptable that the data is not immediately deleted if the retention period is appropriate and the data is deleted in the afterthought as quickly as possible. B, for example, via the next erasure/destruction cycle of the subcontractor. You should also check all bid contracts used with new suppliers to ensure that minimum requirements for the RGPD are included in contracts with your agency`s suppliers. Both processors and subcontractors are required under Article 32 to take appropriate technical and organizational measures to ensure the security of the personal data they process, which may include, if applicable, the following: PPI has also created a number of data processing clauses in the form of an endorsement. The addition contains design notes that allow you to tailor the clauses to your agency`s requirements. The addendum can be sent to your existing suppliers, as described in the supplier guide, and can also be used when negotiating and creating new supplier contracts. Be sure to read the vendor`s guide before using the addition, as the guide contains important instructions on how to use the clauses in the addendum. The above requirements apply when your agency appoints suppliers (as data managers) who process personal data on behalf of your agency (for example.

B IT service providers and outsourced wage processing providers, etc.).