1.1 In these conditions “the Contract” means the Agreement concluded between the Council and the Contractor, including all specifications, plans, drawings, instructions to tender, tender documents and all other documents that are relevant to the Contract and also such of these conditions as are included in the terms and provisions of the Contract;
1.2 The following provisions shall have effect with respect to interpretation of the Contract except where the context otherwise requires:
- (a) “the Goods” means all Goods which the Contractor is required under the Contract to supply or in connection with which he is required under the Contract to carry out any service;
- (b) “the Council” means “Belfast City Council”;
- (c) “the Contractor” means the person who by the Contract undertakes to supply the Goods or render such other service for the Council as is provided by the Contract and, where the Contractor is an individual or partnership, the expression shall include the personal representatives of that individual or of the partners, as the case may be, and the expression shall also include any person to whom the benefit of the Contract may be assigned by the Contractor with the consent of the Council;
- (d) “the Contract price” means the price exclusive of Value Added Tax, payable to the Contractor by the Council under the Contract for the full and proper performance by the Contractor of his part of the Contract as determined under the provisions of the Contract but before taking into account the effect of any variation of price conditions of these conditions where those conditions, or any of them, are included in the terms and conditions of the Contract;
- (e) “loss” includes destruction;
- (f) “month” means calendar month;
- (g) “person” includes a corporation;
- (h) “representatives of the Council” in any provision of the Contract means the person duly authorised by the Council to act within the purposes of the provision;
- (i) the masculine includes the feminine;
- (j) the singular includes the plural, vice versa;
- (k) references to any Enactment, Order, Regulation or other similar Instrument shall be construed as a reference to the Enactment, Order, Regulation or Instrument as amended by any subsequent Enactment, Order, Regulation or Instrument;
- (l) “commercially sensitive information” means the information listed by the Contractor in the “Freedom of Information Statement”;
- (m) “confidential information” means all information disclosed by either party to the other in any form or manner, provided that each such item of information would appear to a reasonable person to be confidential or is specifically stated by the disclosing party to be confidential;
- (n) “FOIA” means the Freedom of Information Act 2000.
1.3 The headings to these Conditions shall not affect the interpretation thereof;
1.4 Any decision, act or thing that the Council is required or authorised to take or do under the Contract may be taken or done by any person authorised either generally or specially, by the Council to take or do that decision, act or thing;
1.5 Any notice or other communication whatsoever which the Council is required or authorised by the Contract to give or make to the Contractors shall, without prejudice to any other method, giving or making it, be sufficiently given or made if it is sent by post in a pre-paid letter addressed to the Contractor by name at the last known place of abode or business of the Contractor and if that letter is not returned through the Post Office undelivered that Notice or Communication shall be deemed for the purposes of the Contract to have been given or made at the time at which that letter would in the ordinary course of post be delivered;
2.1 The Goods shall be of the qualities and sorts described and equal in all respects to the samples, patterns, specifications, plans, drawings or any other documents, individually or collectively which form part of the Contract. Except insofar as may otherwise be indicated by a sample, pattern, specification, plan, drawing or other document, the Goods shall be strictly in accordance with the latest British Standard Specification, where such exists, published before the date of the Contract or otherwise shall be to the satisfaction of the Council.
2.2 The Goods shall conform in all respects with the requirements of any statutes, orders, regulations or bye-laws from time to time in force.
2.3 The Goods shall be sufficient for the purpose for which such Goods are ordinarily used and for any particular purpose made known to the Contractor by the Council and the Council relies on the skill and judgement of the Contractor in the supply of the Goods and their execution of the contract.
3. Alteration of specifications, plans, drawings, patterns, samples
3.1 The Council reserves the right to alter from time to time the said samples, patterns, specifications, plans, drawings or other documents and as from a date and to the extent specified by the Council after consultation, where appropriate, with the Contractor and the effect of such proposed alterations. The Goods shall be in accordance with the samples, patterns, specifications, plans, drawings or other documents as so altered.
3.2 Where any such alteration involves an alteration in the cost of, or delivery of, in the period required for the production of any of the Goods which are affected by the alteration, such revision of the contract price or of the time for delivery of those Goods should be made as may be appropriate, save that if pricing fixing forms part of the terms of the Contract, such revision shall be made by the fixing of such new prices as may be attributable to the alteration. Save as aforesaid, the Contract shall remain unaltered;
4.1 The Council may inspect or arrange for the inspection of the Goods, or any of them, in course of production, at the Contractor’s premises at any reasonable time.
4.2 Without prejudice to the Council’s right of inspection under Clause 4.1 of this condition, the Council may inspect or arrange for the inspection of the completed Goods, or any of them, at the Contractor’s premises where the Goods have been produced or after delivery, or as otherwise provided in the Contract.
4.3 When the Council wishes to exercise its right of inspection under this Condition, the Contractor shall give to the representative of the Council full and free access to the said premises as and when required for that purpose and shall provide at its own expense all such accommodation and facilities in connection with the inspection as the Council may reasonably require, and all appliances, materials and labour required for inspection purposes.
5. Acceptance marks
The Contractor, if so required by the Contract, shall at his own expense, mark or permit the representatives of the Council to mark all approved materials, Goods, or parts thereof with the recognised Council marks. In the case of material, Goods or parts thereof which cannot be so marked, the same shall, if required by the said representative, be packed in suitable packages or cases, each of which shall be sealed and shall have the Council mark placed on the Seals.
Unless otherwise provided by the Contract all containers (including packing cases, boxes, tins, drums and wrappings) supplied by the Contractor shall be considered as nonreturnable, and their costs as having been included in the Contract price.
7.1 The Contractor shall hand over the Goods to the Council, or the agent of the Council at the time or times and at the place or places and in the manner specified in the Contract or in orders issued under the Contract and any access to premises and any labour and equipment that may be provided by the Council in connection with delivery shall be provided without acceptance by the Council of any liability whatsoever and the Contractor shall indemnify the Council in respect of any actions, suits, claims, demands, losses, charges, loss and expenses which the Contractor or the Council may suffer or incur as a result of or in connection with any damage or injury (whether fatal or otherwise) occurring in the course of delivery or installation to the extent that any such damage or injury is attributable to any act or omission of the Contractor or any of its subcontractors.
7.2 The time of delivery shall be of the essence.
7.3 When handing over the Goods in accordance with this Condition, the Contractor shall:
- (a) Ensure that the Goods are properly packed and secured as may be stipulated in the Contract and;
- (b) Comply with any additional instructions which from time to time the Council may give with regard to the transportation of the Goods, provided that any extra costs necessarily incurred so doing shall be borne by the Council as an addition to the Contract price;
- (c) Furnish the Council with a Delivery Note giving the number of each order and the particulars of the Goods supplied which shall accompany each delivery of the said Goods.
7.4 When the Contract or any Order issued under the Contract specifies that the Goods shall be handed over ex-works or dispatched to a destination the Contractor shall hand over or dispatch the article or Goods accordingly, consigning them to such destinations as the Council may require.
7.5 When the Goods are handed over in accordance with Clause 7.1 of this Condition, delivery of the Goods shall occur on their being so handed over. When the Goods are handed over or dispatched in accordance with Clause 7.3 of this Condition, delivery of the Goods shall occur on their going into the possession of the Council or its agents.
7.6 Unless the Contract specifically otherwise provides, and subject to the provisions of the Contract, the property in the Goods passes from the Contractor to the Council upon delivery in accordance with Clause 7.4 of this Condition.
7.7 When after delivery any of the Goods are rejected, those Goods shall for the purposes of the Contract be considered as not having being delivered under the Contract and the property in those Goods shall return to the Contractor from the Council provided that this Clause shall have effect only when the Contractor has received notice of rejection.
7.8 Any quantity of Goods supplied in excess of that ordered and all empties shall be returned at the Contractor’s risk and expense unless otherwise stated.
8. Rendering of bills
All Bills shall be sent, within thirty days from the date of delivery of the Goods, to Belfast City Council as follows:
Central Transactions Unit
Belfast City Council
The Cecil Ward Building
4–10 Linenhall Street
Belfast BT2 8BP
Tel: 028 9027 0319
9. Recovery of sums due
Whenever under the Contract any sum of money shall be recoverable from or payable by the Contractor, the same may be deducted from any sum then due or which at any time thereafter may become due to the Contractor under the Contract or under any other Contract with the Council.
10. Invoices and payment
10.1 The Contractor shall submit an invoice to the Council for the attention of the Central Transactions Unit as specified in the Contract or within 28 days of the completion of the Services. All invoices shall quote the Contract number and, where appropriate, the purchase order number.
10.2 The Contractor shall submit with the invoice such records as the Council may reasonably require including, but not limited to time sheets, expenses incurred, invoices paid or any other documents which would enable the Council to verify the information and the amounts referred to in that invoice.
10.3 The Contractor shall provide to the Council the name and address of his bank, the account name and number, the bank sort code and any other details, in whatever format the Council may require.
10.4 The Council shall pay the Contractor in respect of the satisfactory performance of the Services in accordance with the Contract.
10.5 Except where otherwise provided in the Contract, the amount payable to the Contractor for the performance of the Services shall be inclusive of all costs of staff, facilities, equipment, materials and all other expenses whatsoever incurred by the Contractor in discharging his obligations under the Contract.
10.6 The Council is committed to prompt payment in accordance with statutory legislation and shall pay the Contractor within 30 days of the receipt of a valid invoice, provided that the Council is satisfied that the Services for which the invoice relates have been performed fully in accordance with the Contract.
10.7 The Contractor shall be bound by the Council’s Standing Order 67 and Financial Regulation H.
11. Value added tax
The Council shall pay to the Contractor the amount of any VAT chargeable in respect of the performance of the Services in accordance with Contract.
12. Progress reports
The Contractor shall render such reports as to the progress of the Contract and in such form and at such frequency as may reasonably be called for by the Council. The submission and acceptance of these reports shall not prejudice the rights of the Council under Condition No. 14 (default).
13. Issues of council property
13.1 All Council property issued in connection with the Contract (hereinafter called “issued property” ) shall remain the property of the Council whether paid for by or charged against the Contractor or not and shall be used in the execution of the Contract and for no other purpose whatsoever, without the prior written approval of the Council. If requested, the Council will notify the Contractor, within a reasonable time, of the current value of issued property.
- (a) Upon receipt of issued property, the Contractor shall subject it to:
- (b) Where the Contractor cannot reasonably carry out the additional inspection and testing within the prescribed period as recorded by Clause 11.2(a) of this Condition, whether after receipt or unpacking as the case may be, he shall inform the Council promptly of the position and shall carry out such inspection and testing as soon as is practicable thereafter and shall notify the Council within 7 days of completion of such inspection and testing of any defects or deficiencies thereby discovered.
13.3. The Council shall within a reasonable time of receipt of any notice under Clause 11.2 of this Condition replace, re-issue or authorise repair of issued property agreed to be defective or deficient and if appropriate in the circumstances the Council shall revise the Contract price and/or the time specified in the Contract for delivery of the Goods. Should the Council fail to replace, re-issue, or authorise repair of defective or deficient issued property within a reasonable time (of receipt of notice under Clause 11.2 of this condition) such revisions of the Contract price and/or of the times specified in the Contract for delivery of the Goods shall be made as may be appropriate provided that the Contractor shall have taken all reasonable measures to mitigate the consequences of any delay.
13.4 The Contractor shall be responsible for the safe custody and, subject to Clause 11.5 of this Condition, due return of issued property, whether or not incorporated in the Goods, and shall be responsible for all loss thereof or damage thereto from whatever cause (except as provided below) until re-delivered in accordance with the Council’s instructions. For the purposes of this Condition, defects or deficiencies notified to the Council in accordance with Clause 11.2 of this Condition or deterioration in issued property resulting from its normal and proper use in the execution of the Contract shall not be deemed to be loss or damage (except insofar as the deterioration is contributed to by any misuse, lack of care or want of maintenance by the Contractor). Except as hereinafter provided, the Contractor shall not be liable for loss or damage of the issued property arising from:
- (a) aircraft or other aerial devices dropped therefrom, including pressure waves caused by aircraft or such devices whether travelling at sonic or supersonic speeds,
- (b) ionising radiations or contamination by radioactivity from any nuclear fuel or from nuclear waste from the combustion of nuclear fuel,
- (c) the radioactive, toxic, explosive or any other hazardous properties of any nuclear assembly or nuclear component thereof
- (d) riot, civil commotion, civil war, rebellion, revolution, insurrection, military or a usurped power or enemy risks provided that the Contractor shall be so liable to the extent that any of the aforementioned risks are covered by existing insurance.
13.5 Instructions for the return or disposal of the defective or deficient issued property shall be issued by the Council and such property shall not be at the risk of the Contractor once it has been delivered in accordance with the Council’s instructions.
13.6 If any Goods in which issued property has been incorporated is damaged or rejected or are subject to additional costs by reason of a defect or deficiency in the issued property which is not and could not reasonably have been discovered by the Contractor and notified to the Council in accordance with the provisions in Clause 11.2 of this Condition and provided that such defect or deficiency shall not be attributable to any misuse, lack of care, want of maintenance by the Contractor, the Council shall replace, re-issue or authorise repair of the issued property and shall make such revision of the Contract price and/or of the time specified in the Contract for delivery of the Goods as may be appropriate provided that the Contractor shall have taken all reasonable measures to mitigate the consequences of any delay.
13.7 Neither the Contractor nor any Sub-Contractor, nor any other person shall have a lien on issued property whether paid for by or charged against the Contractor or not, for any sum due to the Contractor or other person, and the Contractor shall take all such steps as may be reasonably necessary to ensure that the title of the Council, and the exclusion of any such lien, are brought to the notice of all Sub-Contractors and other persons dealing with any issued property.
14. Loss of or damage to the goods
14.1 The Contractor is responsible for the Goods and any materials, equipment, fitting or things acquired or allocated by him for incorporation therein until delivery has been effected in accordance with Condition 7 and shall make good any loss of or damage to the Goods or any such material equipment fitting or things however occasioned which may occur before such delivery.
14.2 The Provisions of Clause 12.1 of this Condition shall apply notwithstanding that the Goods concerned may have been inspected in accordance with the Contract or that the property therein may in accordance with the provisions of the Contract where applicable have passed from the Contractor to the Council or its agent earlier than upon delivery.
14.3 Unless the Contract specifically or otherwise provides, the Contractor is not responsible for loss of or damage to the Goods after delivery save that he shall become responsible in all respects for any Goods which the Council rejects after delivery and such responsibility shall take effect upon the Contractor removing the Goods in accordance with the Contract or upon return of the Goods to the Contractor or, if he fails so to remove the Goods, or if the Council does not exercise the right to return the Goods, on the expiry of the 8th working day from his receipt of notification of rejection of the Goods.
14.4 Notwithstanding the provisions of Clause 12.3 of this Condition, the Contractor shall not be responsible for any Goods which remain in the possession of the Council after the Council has rejected them if and for so long as they remains after notice of objection to the rejection has been given under the terms of the Contract and the dispute between the parties relating to the rejection remains unresolved.
15. Value added tax
If the Council so pay the Contactor, in addition to the Contract price, a sum equal to the Value Added Tax chargeable on the value of the supply of the Goods.
16.1 Should the Goods or any portion thereof not be delivered within the time or time specified in the Contract, or in a Warrant or Order where used, the Council may without prejudice to any other remedies, by notice to the Contractor determine the Contract either as respects the Goods which have not been delivered in accordance with the Contract at the time of such determination or as respects all the Goods to which the Contract relates other than those delivered in accordance with the Contract before that time.
16.2 Where the Council has determined the Contract under Clause 14.1 hereon and without prejudice as aforesaid the Council may replace all or any of the Goods with respect to which the Contract is determined by purchasing or manufacturing other Goods of the same or similar description, or by allocating other Goods of the same or similar description in the possession or control of the Council to the purposes for which the Goods replaced are required and there shall be recoverable from the Contractor of the amount by which the aggregate of the cost of purchasing and of manufacturing Goods in this way and of the value of any Goods allocated as aforesaid exceeds the amount which would have been payable to the Contractor in respect of all the Goods so replaced if that they had been delivered in accordance with the Contract.
17. Bankruptcy etc
The Council may at any time by notice in writing summarily determine the Contract without compensation to the Contractor in any of the following events:
- (a) the Contractor being an individual or where the Contractor is a firm, any partner in that firm, shall at any time become bankrupt, or shall have a receiving order or administration order made against him, or shall make any composition or arrangement with or for the benefit of his creditors, or shall make any Conveyance or Assignment for the benefit of his creditors or shall purport to do so, or if in Scotland, he shall become insolvent or notour bankrupt, or any application shall be made under the Insolvency legislation for the time being in force for sequestration of his estate, or a trust deed shall be granted by him for behoof of his creditors;
- (b) if the Contractor, being a company, shall pass a resolution, or the Court shall make an order, that the Company shall be wound up, or if a receiver or manager on behalf of a Creditor shall be appointed, or if circumstances shall arise that entitle the Court or a creditor to appoint a Receiver or Manager which entitle the Court to make a winding up order; Provided always that such determination shall not prejudice or affect any right of action or remedy which shall have accrued or shall accrue thereafter to the Council;
The Contractor shall not unlawfully discriminate within the meaning and scope of the provisions of the Race Relations (NI) Order 1997, Sex Discrimination (NI) 1976 (as Amended), Fair Employment and Treatment (NI) Order 1998 and the Disability Discrimination Act 1995 and shall take all reasonable steps to ensure that all servants, employees or agents of the Contractor and all Sub-Contractors employed in the execution of the Contract do not unlawfully discriminate. This Condition shall not in any way relieve the Contractor of his general obligations to comply with any legislative requirements as provided in the Contract.
19. Transfer and sub-letting
The Contractor shall not give, bargain, sell, assign, sublet or otherwise dispose of the Contract or any part thereof or the benefit or advantage of the Contract or any part thereof without the previous consent in writing of the Council.
20. Corrupt gifts and payments of commission
20.1 The Contractor shall not receive or agree to receive from any person, or offer or agree to give to any person, or procure for any person any gift or consideration of any kind as an inducement or reward for doing or not doing anything, or for showing favour or disfavour to any person in relation to the Contract or any other contracts for the Council.
20.2 The Contractor shall not conspire with any person to do any of the acts mentioned in Condition (18.1)
- (a) Breach by the Contractor of this Condition or; (b) commission of an offence by the Contractor under the Prevention of Corruption Act 1889-1916 or Section 46-47 Local Government Act (NI) 1972 in relation to this or any other Contact with the Council; shall entitle the Council to terminate the Contract and recover from the Contractor the amount of any loss resulting from such termination and recover from the Contractor the amount or value of any such gift, consideration or commission.
- 20.4 The decision of the Council in relation to this condition shall be final and conclusive.
21.1 The Council may reject any Goods which on inspection and in accordance with the Contract are found not to conform to the requirements of the Contract.
21.2 The Council may reject the whole of any consignment of the Goods if inspection in accordance with the Contract shows that:
- (a) such proportion or percentage of the Goods in that consignment as the Contract may specify as being appropriate for the purposes of this condition, or
- (b) Samples taken indiscriminately from that consignment, whether of the Goods or of the material in the Goods do not conform with the requirements of the Contract
21.3 When under this Condition the Council rejects any of the Goods after delivery, the Contractor shall, subject to the provisions of Clause 19.6 of this Condition, at its own expense, remove from the Council each and every of the rejected Goods and shall do so within such period as provided by the Contract, or if the Contract makes no such provision, within 8 working days of receiving notification of rejection.
21.4 If the Contractor shall fail to remove the Goods or any of them in accordance with Clause 19.3 of this Condition the Council may return the rejected Goods or any of them to the Contractor at the Contractor’s risk, the cost of carriage being recoverable from the Contractor.
21.5 When under this Condition the Council rejects any Goods or consignment after delivery, the Contractor shall at his own expense deliver in the place of each and every of the rejected Goods, Goods which conform with the requirements of the Contract and shall do so within the period for delivery stipulated in the Contract or within such further reasonable period as the Council may allow.
21.6 If the Contractor considers himself aggrieved by a rejection under this Condition, he may give the Council notice of objection. To be effective, such notice shall be given with 8 working days from receipt of notification of rejection and before removing the rejected Goods from the Council. The objection shall constitute a dispute between the parties which if not otherwise resolved between the parties within a reasonable time shall be dealt with in accordance with the provisions of the Contract relating to the settlement of disputes. If the Contractor gives notice of objection the Goods shall not be removed until the Council directs.
21.7 If any of the Goods whether completed or in course of production are rejected on inspection by the Council, the same shall, if the Council so requires, be marked in such a manner satisfactory to the Council as to ensure the subsequent identification of same as rejected Goods.
Subject to the provisions of the Contract the Guarantee Period applicable to the Goods shall be twelve months including end of service for eighteen months from delivery whichever shall be the shorter. If the Council shall within such Guarantee Period or within thirty days thereafter give notice in writing to the Contractor of any defect in any of the Goods which may have arisen during such Guarantee Period under proper and normal use the Contractor shall (without prejudice to any other rights or remedies which the Council may have) as quickly as possible remedy such defects (whether by repair or replacement as the Council may elect) without cost to the Council.
Acceptance of the Goods shall take place when the Council confirms acceptance of the Goods in accordance with the procedure specified in the contract, or if none is so specified, then the Council shall be deemed to have accepted the Goods without prejudice to any other remedies, when or as soon as the following events have occurred:
- (a) the Council has taken the Goods into use
- (b) the Council has not exercised its right of rejection of the Goods under the Contract within any period specified for that purpose
- (c) there being no period for exercising the right of rejection specified in the Contract, a reasonable time, all the circumstances having been taken into account, has elapsed since delivery of the Goods was effected in accordance with the Contract.
24. Law (Northern Ireland)
The Contract shall be considered as a contract made in Northern Ireland and subject to Northern Irish Law.
25.1 Each Party:
- (a) shall treat all Confidential Information belonging to the other Party as confidential and safeguard it accordingly; and
- (b) shall not disclose any Confidential Information belonging to the other Party to any other person without the prior written consent of the other Party, except to such persons and to such extent as may be necessary for the performance of the Contract or except where disclosure is other wise expressly permitted by the provisions of this Contract.
25.2 The Contractor shall take all necessary precautions to ensure that all Confidential Information obtained from the Council under or in connection with the Contract:
- (a) is given only to such of the Staff and professional advisors or consultants engaged to advise it in connection with the Contract as is strictly necessary for the performance of the Contract and only to the extent necessary for the performance of the Contract;
- (b) is treated as confidential and not disclosed (without prior Council approval) or used by any Staff or such professional advisors or consultants otherwise than for the purposes of the Contract;
25.3 The Contractor shall ensure that Staff or its professional advisors or consultants are aware of the Contractor’s Confidentiality obligations under this Contract.
25.4 The Contractor shall not use any Confidential Information it receives from the Council otherwise than for the purposes of the Contract.
25.5 The provisions of Clauses 23.1 to 23.4 shall not apply to any Confidential Information received by one Party from the other:
- (a) which is or becomes public knowledge (otherwise than by breach of this Condition);
- (b) which was in the possession of the receiving Party, without restriction as to its disclosure, before receiving it from the disclosing Party;
- (c) which is received from a third party who lawfully acquired it and who is under no obligation restricting its disclosure;
- (d) which is independently developed without access to the Confidential Information; or
- (e) which must be disclosed pursuant to a statutory, legal or parliamentary obligation placed upon the Party making the disclosure, including any requirements for disclosure under the FOIA, or the Environmental Information Regulations pursuant to Condition 24.3 (Freedom of Information).
25.6 Nothing in this Condition shall prevent the Council:
- (a) disclosing any Confidential Information for the purpose of:
- (b) disclosing any Confidential Information obtained from the Contractor:
25.7 Nothing in this Condition shall prevent either Party from using any techniques, ideas or know-how gained during the performance of the Contract in the course of its normal business, to the extent that this does not result in a disclosure of Confidential Information or an infringement of Intellectual Property Rights.
25.8 In the event that the Contractor fails to comply with this Condition 23, the Council reserves the right to terminate the Contract by notice in writing with immediate effect.
26. Freedom of Information
26.1 The Contractor acknowledges that the Council is subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and co-operate with the Council (at the Contractor’s expense) to enable the Council to comply with these Information disclosure requirements.
26.2 The Contractor shall and shall procure that its sub-contractors shall:
- (a) transfer the Request for Information, as defined in the FOIA or the Environmental Information Regulations, to the Council as soon as practicable after receipt and in any event, within [two] Working Days of receiving a Request for Information:
- (b) provide the Council with a copy of all Information in its possession or power in the form that the Council requires within [five] Working Days (or such other period as the Council may specify) of the Council requesting that Information; and
- (c) provide all necessary assistance as reasonably requested by the Council to enable the Council to respond to a Request for Information within the time for compliance set out in section 10 of the FOIA [or regulation 5 of the Environmental Information Regulations].
26.3 The Council shall be responsible for determining at its absolute discretion whether the Commercially Sensitive Information and/or any other information:
- (a) is exempt from disclosure in accordance with the provisions of the FOIA or the Environmental Information Regulations;
- (b) is to be disclosed in response to a Request for Information, and in no event shall the Contractor respond directly to a Request for Information, unless expressly authorised to do so by the Council;
26.4 The Contractor acknowledges that the Council may be obliged under the FOIA, or the Environmental Information Regulations, or any regulations or guidelines made thereunder, to disclose Information:
- (a) without consulting with the Contractor, or
- (b) following consultation with the Contractor and having taken its views into account.
26.5 The Contractor shall ensure that all information produced in the course of the Contract or relating to the Contract is retained for disclosure and shall permit the Council to inspect such records as requested from time to time.
26.6 The Contractor acknowledges that any lists or schedules provided by it outlining Confidential Information or Commercially Sensitive Information are of indicative value only and that the Council may nevertheless be obliged to disclose Confidential Information or Commercially Sensitive Information in accordance with Clause 24.4.
All disputes, differences or questions between the parties to the contract with respect to any matter or thing arising out or relating to the contract (other than a matter of thing as to which the decision of the Council is under the Contract to be final and conclusive, except to the extent to which special provision for arbitration is made elsewhere in the contract), shall be referred to either:
- (a) The arbitration of two persons, one to be appointed by the Council, one by the contractor, or
- (b) Their umpire In accordance with the provisions of the Arbitration Act 1996 for any statutory modification or enactment thereof for the time being in force.
28. Use of documents, information etc
28.1 The Council reserves the general right to disclose information about this Contract, unless otherwise agreed in writing.
28.2 Except with the consent in writing of the Council, the Contractor shall not disclose the contract or any provision thereof to any person other than a person employed by the Contractor in the carrying out of the Contract or any Sub Contractor, Supplier or other person concerned with same. Such disclosure shall be made in confidence and shall extend so far only as may be necessary for the purposes of the contract.
28.3 Except with the consent in writing of the Council the Contractor shall not make use of the Contract or any information issued by or on behalf of the Council otherwise than for the purpose of the Contract, and, save as provided for in clause 3, the Contractor shall not make any article or good or part thereof similar to the Goods for any other purpose.
28.4 Subject to any rights of third parties, nothing in this Condition shall, however, constrain the use for any purpose by the Contractor of any specifications, plans, drawings and other documents, the rights of which vest in him otherwise in a result of work carried out under this Contract.
28.5 Any samples or patterns or any specifications, plans, drawings, or any other documents issued by or on behalf of the Council for the purposes of the contract remain the property of the Council and must be returned on completion of the contract.
29. Patents and information
29.1 It shall be a condition of this contract that, except to the extent that the Goods are made up in accordance with designs furnished by the Council, none of the Goods will infringe any patent, trademark, registered design, copyright or other right in the nature of industrial property of any third party and the Contractor shall indemnify the Council against all actions, suits, claims, demands, losses, charges, costs and expenses which the Council may suffer or incur as a result of or in connection with any breach of this condition.
29.2 All rights (including ownership and copyright) in any specification, instructions, plans, drawings, patterns, models, designs or other materials furnished to or made available to the Contractor by the Council pursuant to this order shall remain vested solely in the Council and the Contractor shall not (except to the extent necessary for the implementation of this contract), without prior written consent of the Council use or disclose any such specifications, plans, drawings, patterns, models or designs or any information (whether or not relevant to this Order) which the Contractor may obtain pursuant to this contract and in particular (but without prejudice to the generality of the foregoing) the Contractor will not refer to the Council or the contract in any advertisement without the Council’s prior written agreement.
30. Delivery under warrants or orders
30.1 A written order shall be issued for each requirement of a quantity of the Goods.
30.2 The Council shall acknowledge in writing receipt of an order within 3 working days of receipt of same, or in the case of order marked “very urgent” by return of post. If the Contractor is unable to effect delivery within the time stated in the order he will state the earliest date by which he is willing to effect delivery and the reason for his inability to deliver the Goods within the time originally required by the order, and it shall be open to the Council by notice in writing either to cancel the order in whole or in part and obtain the required articles elsewhere one day extra cost to the Council being borne by the Contractor or to accept the delivery offered by the Contractor.
31.1 The price quoted in a tender document shall remain fixed (not subject to variation).
32. Health and safety
The Contractor represents and warrants to the Council that the Contractor has satisfied himself that all necessary tests and examinations have been made or will be made prior to the delivery of the Goods to ensure that the Goods are designed and constructed so as to be safe without risk to the health or safety of persons using the same and, that he has made available to the Council adequate information about the use for which the Goods have been designed and have been tested and about any conditions necessary to ensure that when put to use the Goods will be safe and without risk to health. The Contractor shall indemnify the Council against all actions, suits, claims, demands, losses, charges, costs and expenses which the Council may suffer and incur as a result of or in connection with any breach of this condition.
33. Indemnity and insurance
33.1 Without prejudice to any rights or remedies of the Council (including the Council’s rights and remedies under the Contract) the Contractor shall indemnify the Council against all actions, suits, claims, demands, losses, charges, costs and expenses which the Council may suffer or incur as a result of or in connection with any damage to property or in respect of any injury (whether fatal or otherwise) to any person which may result directly or indirectly from any defect in the Goods or the negligent or wrongful act or omission of the Contractor.
33.2 The Contractor shall effect with a reputable insurance company a policy or policies of insurance covering the matters which are the subject of indemnities under these conditions and shall at the request of the Council produce the relevant policy or policies together with receipts or other evidence of payment of the latest premium due thereunder.
34. Meetings and reports
34.1 The Contractor shall attend all meetings arranged by the Council for the discussion of matters connected with the Contract. 34.2 Without prejudice to the submission of reports as specified under the Contract, the Contractor shall render such reports as to the performance of the Contract at such time or times, and in such form as the Council may reasonably require.
35. Merger, takeover or change of control
The Contractor shall forthwith inform the Council in writing of any proposal or negotiations which may or will result in a merger, takeover, change of control, change of name or status of the Contractor (being a Company as defined in the Companies (NI) Order 1986 – 1990) shall inform the Council of any such change as defined in Section 416 of the Income Incorporation Taxes 1988. The Contractor shall comply with any request by the Council for information arising from this condition.
36. Unsatisfactory performance
36.1 Where, in the opinion of the Council, the Contractor has failed to perform the whole or any part of the Contract, to the standard of skill, care and diligence which a competent and suitably qualified Contractor performing the same contract could reasonably be expected to exercise, or in accordance with the contract, the Council may give the Contractor a Notice specifying the way in which his performance falls short of the requirements of the contract, or is otherwise unsatisfactory.
36.2 Where the Contractor has been notified of a failure in accordance with condition 34.1 the Council may:
- (a) Request from the Contractor that, at his own expense and as specified by the Council, he re-schedules and performs the contract to the Council’s satisfaction within such period as may be specified by the Council in the Notice including where necessary, the repair or re-supply of any goods already supplied; or
- (b) Withhold or reduce payments to the Contractor, in such amount as the Council deems appropriate in each particular case.
36.3 The waiver of any right or remedy arising from the breach of contract shall not constitute a waiver of any right or remedy arising from any other breach of the contract.
37. Termination of the contract
Without prejudice to any other power of termination, the Council may terminate the contract without notice, for any of the following reasons:
- (a) The breach by the Contractor of any of conditions 16 (discrimination), 18 (corrupt gifts and payments of commission), 26 (use of documents, information etc) of the contract, or any other material breaches of contract;
- (b) The failure by the Contractor to comply with a Notice given under condition 34 (unsatisfactory performance) within fourteen days from the date of that Notice;
- (c) The Contractor ceases or proposes to cease to carry on business;
- (d) There is a change of control of the type referred to in condition 33 (merger, takeover or change of control), and the Council is not agreed in advance in writing to the particular change of control, save that in this event the Council shall give one month’s notice in writing to the Contractor.
The Council shall in addition to any powers under any of these conditions have power to terminate the contract at any time by giving the Contractors one month’s written notice. Upon the expiry of the notice the contract shall be terminated without prejudice to the rights of the parties accrued to the date of termination.
39. Consequences of termination and break
39.1 Where the contract is terminated under condition 35 (termination of contract), the following provisions shall apply:
- (a) Any sum due or accruing from the Council to the Contractor may be withheld or reduced by such amount as the Council in either case considers reasonable and appropriate in the circumstances;
- (b) The Council may make other arrangements which are actually necessary to procure the orderly supply of the Goods including the letting of another Contract or contracts;
- (c) Where the total cost reasonably and properly incurred by the Council by reason of such arrangements exceed the amount that would have been payable to the Contractor for the completion of the services, the excess shall, subject to any overall limitation of liability contained in condition 38, be recoverable from the Contractor the Council reserves the right to recover such excess by set off against any amount withheld by the Council under condition 37.1(a) or as otherwise provided for under the contract.
39.2 Without prejudice to condition 37.1, where the contract is terminated under condition 37.1 or condition 36 (break), the Contractor shall have the right to claim from the Council reimbursement of all reasonable costs necessarily and properly incurred by him in relation to the orderly cessation of the supply of the Goods, including any commitments, liabilities or expenditure which are reasonably and properly incurred, and would otherwise represent an unavoidable loss by the Contractor by reason of the termination of the contract. For the avoidance of doubt the Council will not indemnify the Contractor against loss of profit. The Council shall not in any case be liable to pay under the provisions of this condition any sum which, when taken together with any sums paid or due or becoming due to the Contractor under the contract, shall exceed the total contract price.
39.3 Where the contract is terminated under condition 35 or condition 36 the Council may, during any notice period:
- (a) Direct the Contractor, where the supply of Goods has not been commenced, to refrain from commencing such supply or where the supply has been commenced, to cease same immediately;
- (b) Direct the Contractor to complete in accordance with the contract the supply of all or any of the Goods, or any part or component thereof, which shall be paid at the agreed contract price or, where no agreement exists at a fair and reasonable price.
40. Loss or damage
40.1 Condition 38 applies to any loss or damage which arises out of or is any way connected with the performance of the contract and shall include, for the avoidance of doubt without prejudice to the generality of the foregoing, breaches of conditions 39 and 40.
40.2 The Contractor shall, without delay and at his own expense, replace or make good to the satisfaction of the Council, or if the Council requires, compensate the Council for, any loss or damage.
40.3 If any loss or damage:
- (a) Was not caused or contributed to by the Contractor’s neglect or default, whether by act, or omission or otherwise (for the purposes of this condition 37.3, “the Contractor” shall include his servants, agents or sub-contractors), he shall be under no liability under this condition 38;
- (b) Was in part caused or contributed to the Contractor’s neglect or default, whether by act, omission or otherwise and in part by:
40.4 In this condition 38 loss or damage includes:
- (a) Loss or damage to property;
- (b) Personal injury and death;
- (c) Loss of property or loss of use;
- (d) Any other loss.
41. Data protection
Annex A and Schedule One thereto are applicable to this Contract and are incorporated herewith.
42. Royalties and licence fees
The Contractor shall ensure that all royalties, licence fees or similar expenses in respect of all intellectual property used in connection with the contract has been paid and are included within the contract price.
43. Retention of documentation
The Contractor shall retain, produce and require (and explain as necessary) such accounts, documents (including working documents) and records as the Council may request in connection with the contract, at any time during the contract and for a period of two years from the date of expiry or termination or such longer period as may be agreed between the Council and the Contractor in writing at or before the commencement of the contract; and afford such facilities as the Council may reasonably require his representatives to visit the Contractor’s premises and examine the records under this condition.
44. Transfer of responsibility
44.1 In the event that a different organisation is required to take over the supply of the Goods at the expiry or termination of the contract, the Contractor shall co-operate the transfer, under arrangements to be notified to him by the Council.
44.2 Transfer shall be arranged between the Council and the Contractor so as to reduce to a minimum any interruption in the supply of the Goods.
If any provision of these conditions is held invalid, legal or enforceable for any reason by any Court of competent jurisdiction, such provision shall be severed and the remainder of the provisions of the Contract shall continue in full force and effect as if the Contract had been executed with the illegal, invalid wrong of unenforceable provision eliminated. In the event of a holding of invalidity so fundamental as to prevent the accomplishment of the purpose of the Contract, the Council and the Contractor shall immediately commence negotiations in good faith to remedy the invalidity.
46.1 The failure of the Council or the Contractor to exercise any right or remedy shall not constitute a waiver of that right of remedy.
46.2 The waiver shall be effective unless it is communicated to either the Council or the Contractor in writing.
46.3 A waiver of any right or remedy arising from a breach of contract shall not constitute a waiver of any right or remedy arising from any other breach of the contract.
47. Rights of third parties
Nothing in this contract confers or purports to confer on any third party any right to enforce any term of the contract.
48. Conflict of provisions
Where there is any conflict between any terms and conditions of the Contractor and these Conditions, these Conditions will prevail.
Annex A Part 1: Generic standard UK GDPR clauses
Customer: [to be completed as appropriate]
Contractor: [to be completed as appropriate]
Party: a Party to this Agreement
Agreement: this contract
Law: means any law, subordinate legislation within the meaning of Section 21(1) of the Interpretation Act 1978, bye-law, regulation, order, regulatory policy, mandatory guidance or code of practice, judgement of a relevant court of law, or directives or requirements with which the Processor is bound to comply
Processor Personnel: means all directors, officers, employees, agents, consultants and contractors of the Processor and/or of any Sub-Processor engaged in the performance of its obligations under this Agreement.
GDPR clause definitions:
Data Protection Legislation: (i) all applicable UK law relating to the processing of personal data and privacy, including but not limited to the UK GDPR, and the Data Protection Act 2018 to the extent that it relates to processing of personal data and privacy; and (ii) (to the extent that it may be applicable) the EU GDPR). The UK GDPR and EU GDPR are defined in section 3 of the Data Protection Act 2018.
Data Protection Impact Assessment: an assessment by the Controller carried out in accordance with Section 3 of the UK GDPR and sections 64 and 65 of the DPA 2018. Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Data Protection Officer take the meaning given in the UK GDPR. Data Loss Event: any event that results, or may result, in unauthorised access to Personal Data held by the Processor under this Agreement, and/or actual or potential loss and/or destruction of Personal Data in breach of this Agreement, including any Personal Data Breach.
Data Subject Request: a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to Data Protection Legislation to access their Personal Data.
DPA 2018: Data Protection Act 2018 UK
GDPR: the UK General Data Protection Regulation
Joint Controllers: takes the meaning given in Article 26 of the UK GDPR
Law Enforcement Processing: processing under Part 3 of the DPA 2018.
Protective Measures: appropriate technical and organisational measures designed to ensure compliance with obligations of the Parties arising under Data Protection Legislation and this Agreement, which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the such measures adopted by it including those outlined in Schedule 1 (Security).
Sub-processor: any third party appointed to process Personal Data on behalf of that Processor related to this Agreement
1. Data protection
1.1 The Parties acknowledge that for the purposes of Data Protection Legislation, the Customer is the Controller and the Contractor is the Processor. The only processing that the Processor is authorised to do is listed in Schedule [X] by the Controller and may not be determined by the Processor. The term “processing” and any associated terms are to be read in accordance with Article 4 of the UK GDPR.
1.2 The Processor shall notify the Controller immediately if it considers that any of the Controller's instructions infringe Data Protection Legislation.
1.3 The Processor shall provide all reasonable assistance to the Controller in the preparation of any Data Protection Impact Assessment prior to commencing any processing. Such assistance may, at the discretion of the Controller, include: (a) a systematic description of the envisaged processing operations and the purpose of the processing; (b) an assessment of the necessity and proportionality of the processing operations in relation to the Services; (c) an assessment of the risks to the rights and freedoms of Data Subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.
1.4 The Processor shall, in relation to any Personal Data processed in connection with its obligations under this Agreement:
(a) process that Personal Data only in accordance with Schedule 1, unless the Processor is required to do otherwise by Law. If it is so required the Processor shall promptly notify the Controller before processing the Personal Data unless prohibited by Law; (b) ensure that it has in place Protective Measures, which are appropriate to protect against a Data Loss Event, which the Controller may reasonably reject. In the event of the Controller reasonably rejecting Protective Measures put in place by the Processor, the Processor must propose alternative Protective Measures to the satisfaction of the Controller. Failure to reject shall not amount to approval by the Controller of the adequacy of the Protective Measures. Protective Measures must take account of the: (i) nature of the data to be protected; (ii) harm that might result from a Data Loss Event; (iii) state of technological development; and (iv) cost of implementing any measures; (c) ensure that : (i) the Processor Personnel do not process Personal Data except in accordance with this Agreement (and in particular Schedule 1); (ii) it takes all reasonable steps to ensure the reliability and integrity of any Processor Personnel who have access to the Personal Data and ensure that they: (A) are aware of and comply with the Processor’s duties under this clause; (B) are subject to appropriate confidentiality undertakings with the Processor or any Sub-processor; (C) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third Party unless directed in writing to do so by the Controller or as otherwise permitted by this Agreement; and (D) have undergone adequate training in the use, care, protection and handling of Personal Data; and (d) not transfer Personal Data outside of the UK unless the prior written consent of the Controller has been obtained and the following conditions are fulfilled: (i) the destination country has been recognised as adequate by the UK government in accordance with Article 45 UK GDPR or section 74 of the DPA 2018; (ii) the Controller or the Processor has provided appropriate safeguards in relation to the transfer (whether in accordance with UK GDPR Article 46 or section 75 DPA 2018) as determined by the Controller; (iii) the Data Subject has enforceable rights and effective legal remedies; (iv) the Processor complies with its obligations under Data Protection Legislation by providing an appropriate level of protection to any Personal Data that is transferred (or, if it is not so bound, uses its best endeavours to assist the Controller in meeting its obligations); and (v) the Processor complies with any reasonable instructions notified to it in advance by the Controller with respect to the processing of the Personal Data; (e) at the written direction of the Controller, delete or return Personal Data (and any copies of it) to the Controller on termination of the Agreement unless the Processor is required by Law to retain the Personal Data.
1.5 Subject to clause 1.6, the Processor shall notify the Controller immediately if it: (a) receives a Data Subject Request (or purported Data Subject Request); (b) receives a request to rectify, block or erase any Personal Data; (c) receives any other request, complaint or communication relating to either Party's obligations under Data Protection Legislation; (d) receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement; (e) receives a request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or (f) becomes aware of a Data Loss Event.
1.6 The Processor’s obligation to notify under clause 1.5 shall include the provision of further information to the Controller, as details become available.
1.7 Taking into account the nature of the processing, the Processor shall provide the Controller with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under clause 1.5 (and insofar as possible within the timescales reasonably required by the Controller) including but not limited to promptly providing: (a) the Controller with full details and copies of the complaint, communication or request; (b) such assistance as is reasonably requested by the Controller to enable the Controller to comply with a Data Subject Request within the relevant timescales set out in Data Protection Legislation; (c) the Controller, at its request, with any Personal Data it holds in relation to a Data Subject; (d) assistance as requested by the Controller following any Data Loss Event; (e) assistance as requested by the Controller with respect to any request from the Information Commissioner’s Office, or any consultation by the Controller with the Information Commissioner's Office.
1.8 The Processor shall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Processor employs fewer than 250 staff, unless: (a) the Controller determines that the processing is not occasional; (b) the Controller determines the processing includes special categories of data as referred to in Article 9(1) of the UK GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the UK GDPR; or (c) the Controller determines that the processing is likely to result in a risk to the rights and freedoms of Data Subjects.
1.9 The Processor shall allow for audits of its Data Processing activity by the Controller or the Controller’s designated auditor.
1.10 Each Party shall designate its own data protection officer if required by Data Protection Legislation.
1.11 Before allowing any Sub-processor to process any Personal Data related to this Agreement, the Processor must: (a) notify the Controller in writing of the intended Sub-processor and processing; (b) obtain the written consent of the Controller; (c) enter into a written agreement with the Sub-processor which give effect to the terms set out in this clause 1 such that they apply to the Sub-processor; and (d) provide the Controller with such information regarding the Sub-processor as the Controller may reasonably require.
1.12 The Processor shall remain fully liable for all acts or omissions of any of its Sub-processors.
1.13 The Parties agree to take account of any guidance issued by the Information Commissioner’s Office. The Controller may upon giving the Processor not less than 30 working days’ notice to the Processor amend this agreement to ensure that it complies with any guidance issued by the Information Commissioner’s Office.
Annex A - Part 2: Schedule of Processing Personal Data and Data Subjects (Schedule X)
Schedule [X] Processing Personal Data and Data Subjects
This Schedule shall be completed by the Controller, who may take account of the view of the Processor, however the final decision as to the content of this Schedule shall be with the Controller at its absolute discretion.
- The contact details of the Controller’s Data Protection Officer are: [Insert Contact details]
- The contact details of the Processor’s Data Protection Officer are: [Insert Contact details]
- The Processor shall comply with any further written instructions with respect to processing by the Controller.
- Any such further instructions shall be incorporated into this Schedule.
|Identity of the Controller and Processor||The Parties acknowledge that for the purposes of Data Protection Legislation, the Customer is the Controller and the Contractor is the Processor in accordance with Clause 1.1.|
|Subject matter of the processing||This should be a high level, short description of what the processing is about i.e. its subject matter of the contract. Example: The processing is needed in order to ensure that the Processor can effectively deliver the contract to provide [insert description of relevant service].|
|Duration of the processing||Clearly set out the duration of the processing including dates.|
|Nature and purposes of the processing||Please be as specific as possible, but make sure that you cover all intended purposes. The nature of the processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means). The purpose might include: employment processing, statutory obligation, or recruitment assessment.|
|Type of Personal Data being Processed||Examples include: name, address, date of birth, NI number, telephone number, pay, images, or biometric data.|
|Categories of Data Subject||Examples include: Staff (including volunteers, agents, and temporary workers), customers/ clients, suppliers, patients, students/pupils, members of the public, users of a particular website.|
|International transfers and legal gateway||Explain where geographically personal data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract.|
|Plan for return and destruction of the data once the processing is complete||Describe how long the data will be retained for, how it will be returned or destroyed.|
Annex B: Security
The technical security requirements set out below provide an indication of the types of security measures that might be considered, in order to protect Personal Data. More, or less, measures may be appropriate depending on the subject matter of the contract, but the overall approach must be proportionate. The technical requirements must also be compliant with legislative and regulatory obligations for content and data, such as UK GDPR.
The example technical security requirements set out here are intended to supplement, not replace, security schedules that will detail the total contractual security obligations and requirements that the Processor (i.e. a supplier) will be held to account to deliver under contract. Processors are also required to ensure sufficient ‘flow-down’ of legislative and regulatory obligations to any third party Sub-processors.
External Certifications e.g. Buyers should ensure that Suppliers hold at least Cyber Essentials Plus certification and ISO 27001:2013 certification if proportionate to the service being procured.
Risk Assessment e.g. Supplier should perform a technical information risk assessment on the service supplied and be able to demonstrate what controls are in place to address those risks.
Security Classification of Information e.g. If the provision of the Services requires the Supplier to Process Authority/Buyer Data which is classified as OFFICIAL,OFFICIAL-SENSITIVE or Personal Data, the Supplier shall implement such additional measures as agreed with the Authority/Buyer from time to time in order to ensure that such information is safeguarded in accordance with the applicable legislative and regulatory obligations.
End User devices e.g.
- The Supplier shall ensure that any Authority/Buyer Data which resides on a mobile, removable or physically uncontrolled device is stored encrypted using a product or system component which has been formally assured through a recognised certification process agreed with the Authority/Buyer except where the Authority/Buyer has given its prior written consent to an alternative arrangement.
- The Supplier shall ensure that any device which is used to Process Authority/Buyer Data meets all of the security requirements set out in the NCSC End User Devices Platform Security Guidance. To read NCSC's information, go to Device security guidance (link opens in new window).
Testing e.g. The Supplier shall at their own cost and expense, procure a CHECK or CREST Certified Supplier to perform an ITHC or Penetration Test prior to any live Authority/Buyer data being transferred into their systems. The ITHC scope must be agreed with the Authority/Buyer to ensure it covers all the relevant parts of the system that processes, stores or hosts Authority/Buyer data.
Networking e.g. The Supplier shall ensure that any Authority/Buyer Data which it causes to be transmitted over any public network (including the Internet, mobile networks or un-protected enterprise network) or to a mobile device shall be encrypted when transmitted.
Personnel Security e.g. All Supplier Personnel shall be subject to a pre-employment check before they may participate in the provision and or management of the Services. Such pre-employment checks must include all pre-employment checks which are required by the HMG Baseline Personnel Security Standard or equivalent including: verification of the individual's identity; verification of the individual's nationality and immigration status; and, verification of the individual's employment history; verification of the individual's criminal record. The Supplier maybe required to implement additional security vetting for some roles.
Identity, Authentication and Access Control e.g. The supplier must operate an appropriate access control regime to ensure that users and administrators of the service are uniquely identified. The supplier must retain records of access to the physical sites and to the service.
Data Destruction/Deletion e.g. The Supplier must be able to demonstrate they can supply a copy of all data on request or at termination of the service, and must be able to securely erase or destroy all data and media that the Authority/Buyer data has been stored and processed on.
Audit and Protective Monitoring e.g. The Supplier shall collect audit records which relate to security events in delivery of the service or that would support the analysis of potential and actual compromises. In order to facilitate effective monitoring and forensic readiness such Supplier audit records should (as a minimum) include regular reports and alerts setting out details of access by users of the service, to enable the identification of (without limitation) changing access trends, any unusual patterns of usage and/or accounts accessing higher than average amounts of Authority/Buyer Data. The retention periods for audit records and event logs must be agreed with the Authority/Buyer and documented.
Location of Authority/Buyer Data e.g. The Supplier shall not, and shall procure that none of its Sub-contractors, process Authority/Buyer Data outside the EEA without the prior written consent of the Authority/Buyer and the Supplier shall not change where it or any of its Sub-contractors process Authority/Buyer Data without the Authority/Buyer's prior written consent which may be subject to conditions.
Vulnerabilities and Corrective Action e.g. Suppliers shall procure and implement security patches to vulnerabilities in accordance with the timescales specified in the NCSC Cloud Security Principle 5. Suppliers must ensure that all COTS Software and Third Party COTS Software be kept up to date such that all Supplier COTS Software and Third Party COTS Software are always in mainstream support.
Secure Architecture e.g. Suppliers should design the service in accordance with:
- NCSC "Security Design Principles for Digital Services"
- NCSC "Bulk Data Principles"
- NCSC "Cloud Security Principles"