SECURITY OBLIGATIONS OF THE PROCESSOR. 3.1 The Processor shall only carry out those actions in respect of the personal data processed on behalf of the Controller as are expressly authorised by the Controller.
SECURITY OBLIGATIONS OF THE PROCESSOR. As the title of this clause would suggest, it sets out the security obligations of the Data Processor with regard to the processing of personal data on behalf of the Data Controller. Important points to note are: - the Processor may only process personal data in accordance with instructions from the Data Controller. It may not process the data for its own purposes; - the Processor is required to take “such Technical and Organisation Security Measures as are required under its own National Law to protect personal data processed on behalf of the Data Controller against unlawful forms of processing”. As mentioned above, legal advice should be obtained as to the detailed requirements of the relevant national law; and - Appendix 1 of the Contract sets out the minimum requirements for compliance with these obligations. Appendix 1 is discussed further below. Clause 4 – Confidentiality This clause ensures that the Processor must treat all personal data processed on behalf of the Data Controller as confidential and provides that the obligation of confidentiality is continue for 5 years after the date on which the Processor ceases processing personal data for the Controller. This time limit is without prejudice to any longer time-limits that may be provided by national law or sector specific regulation. The
