Common use of Subject Access Request Clause in Contracts

Subject Access Request. All Parties will comply with the requirements of the GDPR including Articles 12-22 in relation to subject rights. • 12 – Exercise of the rights of the data subject • 13 – Information to be provided where personal data are collected from the data subject • 14 – Information to be provided where personal data have not been obtained from the data subject • 15 – Right of access by the data subject • 16 – Right to rectification • 17 – Right to erasure (‘right to be forgotten’) • 18 – Right to restriction of processing • 19 – Notification obligation regarding rectification or erasure of personal data or restriction of processing • 20 – Right to data portability • 21 – Right to object • 22 – Automated individual decision-making, including profiling Any Party receiving a written or verbal request for subject access to personal information under Article 15 of the GDPR relating to information shared under this Agreement must direct the request to their Data Protection Officer who will consult with the other Parties prior to the release of any information provided by those Parties. In order to facilitate this, information should be clearly labelled to identify the source Party. If a Party receives a subject access request and personal data is identified as originating from another agency, it will be the responsibility of the receiving agency to contact the data provider within 2 working days (of becoming aware that Operation Encompass forms part of the request) to consult on the application of potential exemptions under the provisions of the Data Protection Act 2018. If a Party receives a request from an individual to exercise a right to erasure, rectification, restrict processing, or objection to processing in respect of information shared under this Agreement, it will be the responsibility of the receiving party to contact the other Party within 2 working days to inform them of the action taken. It will also be the responsibility of the receiving party to inform the individuals about the recipient(s) of the relevant personal data.