Common use of Reasonable and Appropriate Controls Clause in Contracts

Reasonable and Appropriate Controls. The Contractor agrees to implement reasonable and appropriate privacy and security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted Protected University Data furnished by the University, or collected by the Contractor on behalf of the University If information pertaining to student educational records is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with FERPA. If information pertaining to protected health information is accessed, used, collected, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with HIPAA and Contractor shall sign and adhere to a Business Associate Agreement. If Contractor engages in electronic commerce on behalf of the University or cardholder data relating to University activities is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with current PCI-DSS requirements. If information pertaining to protected financial customer information is accessed, transferred, stored or processed by Contractor; Contractor shall protect such data in accordance with GLBA. If information pertaining to persons located in the European Economic Area (EEA) is accessed, transferred, stored, or processed by Contractor; Contractor shall protect, collect, store, transfer, and process such data in accordance with the obligations of a data processor, or in accordance with the obligations of a data controller if specified within the underlying agreement as a data controller, as set forth in the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and shall provide reasonable assistance at the request of the University for fulfillment of requests made pursuant to the rights afforded to data subjects in GDPR Chapter III.