33.1 The Parties shall at all times comply with applicable Data Protection Legislation, which principally and for all purposes relating to the UK, refers to (but is not limited to) The Data Protection Act 2018.
33.2 The Parties have described the processing of personal data being undertaken by KDDI EUROPE in Appendix 1 to this Agreement.
33.3 The Parties acknowledge that for the purposes of the Data Protection Act 2018, the Customer is the data controller and KDDI is the data processor (where “Data Controller” and “Data Processor” have the meanings as defined in the Data Protection Act 2018). A Schedule accompanying these General Terms and Conditions (“Terms”) sets out the scope, nature and purpose of processing by KDDI, the duration of the processing and the types of Personal Data and categories of Data Subject (“Data Processing Schedule”).
33.4 The parties agree to always and only use any personal data that has been collected for specified, explicit and legitimate purposes, for those purposes and never any other purpose. This personal data will not be further processed in a manner that is incompatible with those stated purposes.
33.5 KDDI EUROPE shall in relation to personal data that it processes on behalf of the Customer as a data processor:
33.5.1 act only in accordance with the Agreement and with the instructions of the Customer in relation to the processing of personal data (including instructions in relation to the return or destruction of personal data). In the event that a legal requirement prevents KDDI EUROPE from complying with such instructions or requires KDDI EUROPE to disclose the personal data to a third party KDDI EUROPE shall, unless such legal requirement prohibits it from doing so, inform the Customer of the relevant legal requirement before carrying out the relevant processing activities;
33.5.2 take reasonable steps to ensure the reliability of staff having access to the personal data and that all staff to whom it discloses personal data are made aware that the personal data is confidential information of the Customer and subject to this Section 33 and any confidentiality obligations set out in the Agreement;
33.5.3 have and maintain appropriate technical and organisational measures, in accordance with Data Protection Legislation, to prevent unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data, including operating a security strategy. KDDI EUROPE shall maintain such security measures for as long as it is processing the personal data;
33.5.4 not transfer, or otherwise permit access to, any personal data outside of the United Kingdom (“U.K.”) without the Customer’s prior written consent. In the event that personal data is transferred outside the U.K., unless otherwise agreed in writing by the Customer:
33.5.4.1 the EU standard contractual clauses published by the European Commission pursuant to Article 26(2) of Directive 95/46/EC) or such other equivalent clause as may be approved under Article 46 of the U.K. GDPR or any other equivalent approved clauses under Data Protection Legislation shall apply to transfers of personal data within KDDI EUROPE’s organisation and/or to other members of KDDI Group (and KDDI EUROPE shall procure that each other member of KDDI Group comply with those terms); and
33.5.4.2 KDDI EUROPE shall, and shall procure that any third party to whom the personal data is to be transferred, shall promptly execute and deliver such documents and perform such acts as may reasonably be required to ensure the transfer complies with the Data Protection Legislation.
33.5.5 refrain from disclosing personal data to any third parties other than to permitted sub-contractors to whom disclosure is reasonably necessary in order for KDDI EUROPE to comply with the Agreement and/or comply with the Customer instructions, provided that in all cases:
33.5.5.1 such disclosure is made subject to written terms substantially the same as in this Article 22; and
33.5.5.2 such disclosure has been approved in writing in advance by the Customer.
33.5.6 afford to the Customer (and procure that its permitted sub-contractors afford to the Customer) access on reasonable notice and at reasonable intervals to any premises, facilities or equipment used to process relevant personal data to enable the Customer to ensure that KDDI EUROPE is complying with its obligations under this Article 22 and/or that KDDI EUROPE's permitted sub-contractors are complying with the equivalent contractual obligations imposed on them;
33.5.7 at no additional cost, provide such information and assistance to the Customer as the Customer may reasonably require, and within the timescales reasonably specified by the Customer, in order to allow the Customer to comply with:
33.5.7.1 at no additional cost, provide such information and assistance to the Customer as the Customer may reasonably require, and within the timescales reasonably specified by the Customer, in order to allow the Customer to comply with:
33.5.7.2 Articles 32 – 36 (inclusive) of the U.K.GDPR;
33.5.8 as soon as reasonably practical, and in any event within 48 hours, notify the Customer of any Personal Data Breach. KDDI EUROPE shall provide the Customer with reasonable assistance in the Customer’s compliance with Data Protection Legislation in relation to the Personal Data Breach; and
33.5.9 on termination of the Agreement (or as otherwise instructed by the Customer) erase or return the personal data to the Customer (as instructed by the Customer) save that KDDI EUROPE shall be entitled to retain personal data to the extent required by applicable law.