Pay
Report
Apply
Personal data and data subjects
Schedule one: processing personal data and data subjects
- The contractor shall comply with any further written instructions with respect to processing issued by the council.
- Any such further instructions shall be incorporated into this schedule.
| To be completed by contract owner or manager | |
|---|---|
| Contract title | |
|
Subject matter of the processing |
|
| Duration of the processing |
|
| To be completed by contract owner or manager | |
|---|---|
|
Nature and purpose of the processing [section 1] |
|
|
Type of personal data |
|
| Categories of data subject |
|
| Plan for return and destruction of the data once the processing is complete unless requirement under union of member state law to preserve that type of data [section 2] |
|
| Additional information |
|
| To be completed by successful bidder | |
|---|---|
| Supplier name |
|
| Location of the processing [section 3] |
|
1 Nature and purpose of the processing
- Be as specific as possible, but make sure that you cover all intended purposes.
- The nature of the processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means) etc.
- The purpose might include: employment processing, statutory obligation, recruitment assessment etc.
2 Plan for return and destruction of the data
Suggested text:
“Upon written instruction from Belfast City Council, or expiry or termination of this agreement, [CONTRACTOR NAME] shall immediately transfer all council personal data (including in emails, from communication servers, from clients’ or production computers, as well as all intermediate files created in the course of the data processing and all manual or paper files) to the council.”
“After receiving written confirmation from the council of the satisfactory receipt by Belfast City Council of all personal data, [CONTRACTOR NAME] shall promptly delete the electronic and manual personal data permanently and beyond recovery. This deletion will be confirmed in writing [CONTRACTOR NAME] to Belfast City Council.”
3 Location of Processing
- Special category personal data is deserving of additional protection regarding its security, how it is held and who is permitted access. The contractor must provide details of how special category data will be held during the term of the programme, in order to satisfy Belfast City Council.
- No processing of personal data must take place in a public space or in any area or facility to which the public has open access.
Example text:
“The processing will take place on the premises of the contractor with paper data being held in a locked cabinet within a locked office and electronic data held with appropriate technical and organisational measures in place to ensure that there is no unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to the personal data.”