Skip to main content
GDPR applicable

Services: ERDF funded


  1. Definitions and interpretations
  2. Law
  3. Duration of the contract
  4. Alteration of requirement
  5. Duty of care
  6. Contractor's performance
  7. Meetings and reports
  8. Inspection
  9. Invoices and payment
  10. Value added tax
  11. Corrupt gifts and payments of commission
  12. The Fair Employment and Treatment (NI) Order 1998
  13. Disclosures of information
  14. Discrimination
  15. Merger, take-over or change of control
  16. Unsatisfactory performance
  17. Termination of the contract
  18. Break
  19. Consequences of termination and break
  20. Assignment, sub-contractors and suppliers
  21. Insurance
  22. Loss or damage
  23. Confidentiality
  24. Freedom of information
  25. Recovery of sums due
  26. Data protection
  27. Insolvency of the contractor
  28. Royalties and licence fees
  29. Drawings, specifications, software, designs and other data
  30. Retention of documentation
  31. Serving of notices
  32. Arbitration
  33. Transfer of responsibility
  34. Contractor's obligations in connection with TUPE
  35. Use of council facilities
  36. Severability
  37. Waiver
  38. Rights of third parties
  39. Publicity

1. Definitions and interpretations

1.1 In this Contract, unless the context requires otherwise, the following words and phrases shall have the following meanings:-

  1. "Award Date" means the date of the award of the Contract by the Council to the Contractor;
  2. "Contract" means the documents listed in the Council's acceptance letter, including these Conditions and the Specification. In case of discrepancy between these Conditions and other documents forming part of the Contract, these Conditions shall prevail unless otherwise agreed in writing;
  3. "Contract Price" means the price or prices payable to the Contractor by the Council under the Contract for the full and proper performance by the Contractor of his part of the Contract as determined under the provisions of the Contract; 
  4. "Contractor" means the person appointed by the Council for the performance of the Services (including any successors);
  5. "Contractor's Representative" means a competent person appointed by the Contractor to be his representative in relation to the performance of the Contract who will receive and act on any directions given by the Contract Manager;
  6. "Contract Manager" means the official of the Council, or other person appointed by the Council to act on its behalf for the purpose of managing the Contract;
  7. "Council” means Belfast City Council;
  8. "Council’s Property" means anything issued or otherwise provided in connection with the Contract by or on behalf of the Council;
  9. "Key Personnel" means any person who, in the Council's opinion, is fundamental to the performance of the Contract;
  10. "month" means calendar month, unless otherwise defined;
  11. any reference to a "person" shall, as the context may require, be construed as a reference to any individual, firm, company, corporation, Government Department, Agency or any association or partnership (whether or not having a separate legal personality);
  12. "Premises" means any premises occupied, owned or leased by the Council, or as described in the Contract;
  13. "Programme" means any programme or timetable agreed by the parties to the Contract which regulates or specifies the period or periods for the performance of the Services or any part of them, together with any activities ancillary to the performance of the Services or the preparation and submission of reports;
  14. "Service(s)" or "Work" means all Services detailed in the Specification which the Contractor is required to carry out under the Contract;
  15. "Specification" means the description of Services to be performed under the Contract; 
  16. “Commercially sensitive information” means the information listed by the Contractor in the “Freedom of Information Statement”;
    1. which is provided by the Contractor to the Client in confidence for the period set out in that schedule; and/or
    2. that constitutes a trade secret;
  17. “Confidential information” means all information disclosed by either party to the other in any form or manner, provided that each such item of information would appear to a reasonable person to be confidential or is specifically stated by the disclosing party to be confidential;
  18. “FOIA” means the Freedom of Information Act 2000.

1.2 Unless the context requires otherwise, the singular shall include the plural and vice versa, and words expressed in any gender shall include any other gender.

1.3 The headings are inserted for convenience only and shall not affect the interpretation of the Contract.

1.4 Reference to any legislative requirement or similar instrument shall be deemed to include reference to any subsequent amendment to them. 

2. Law

The Contract shall be governed by and interpreted in accordance with Northern Ireland and shall be subject to the jurisdiction of the Courts of Northern Ireland.

3. Duration of the contract

Subject to the Council’s rights of termination under these conditions, the Contract shall be in force from the Award Date and the Services shall be provided throughout the duration of the Contract in accordance with the dates and timetables specified in the Programme, or until the Services are completed to the satisfaction of the Council.

4. Alteration of requirement

The Council reserves the right to alter the requirements of the Contract, as detailed in the Specification, should this at any time become necessary. In the event of any alteration of the contractual requirement, payment under the Contract shall be subject to fair and reasonable adjustment to be agreed between the Council and the Contractor and recorded in writing.

5. Duty of care

The Contractor shall perform the Services with all reasonable skill, care and diligence and in accordance with all relevant legislative and statutory requirements.

6. Contractor's performance

6.1 The Contractor shall properly manage and monitor performance of the Services and immediately inform the Contract Manager if any aspect of the Contract is not being or is unable to be performed.

6.2 The Contractor shall provide all the necessary facilities, materials and any other equipment, and personnel of appropriate qualifications and experience to undertake the Services. All personnel deployed on work relating to the Contract shall have appropriate qualifications and competence, be properly managed and supervised and in these and any other respects be acceptable to the Council. If the Council gives the Contractor notice that any person is to be removed from involvement in the Services, the Contractor shall take immediate steps to comply
with such notice. The decision of the Council regarding the Contractor's personnel shall be final and conclusive.

6.3 The Contractor shall:-
(a) give the Council, if so requested, full particulars of all persons who are or may be at any time employed on the Contract;
(b) comply with any rules, regulations and any safety and security instructions from the Council, including completion of any additional clearance procedures required by the Council, and return of any passes as required.
6.4 The Contractor shall take all reasonable steps to avoid changes to any of the staff designated in the Contract as Key Personnel. The Contractor shall give at least one month's notice to the Contract Manager of any proposals to change Key Personnel and Condition 6.2 shall apply to the proposed replacement personnel.

6.5 Unless otherwise agreed by the Council, neither the Contractor nor any of his employees or agents shall carry out any business or trading activity within the confines of the Premises and no advertisement, sign or notice of any description shall be exhibited without prior approval, in writing, from the Council.

6.6 The Contractor shall exercise due care and propriety when dealing with third parties in connection with the Contract and ensure that no commitments are entered into (unless expressly required under the Contract), without the Council's prior written consent.

6.7 Nothing in the Contract shall be construed as creating a partnership, a contract of employment or a relationship of principal and agent between the Council and the Contractor.

7. Meetings and reports

7.1 The Contractor shall attend all meetings arranged by the Council for the discussion of matters connected with the performance of the Services. 

7.2 Without prejudice to the submission of reports as specified under the Contract, the Contractor shall render any additional reports as to the performance of the Services at such time or times, and in such form as the Contract Manager may reasonably require.

8. Inspection

During the course of the Contract the Council or its nominated agencies including DETI and its agents, Invest NI, the Northern Ireland Audit Office, the European Commission and the European Court of Auditors shall have the power to inspect and examine any of the Services on the Premises at any reasonable time. Where the Services are being performed on any other premises, the Contract Manager or the Council shall on giving reasonable notice to the Contractor be entitled to inspect and examine such Services. The Contractor shall provide free of charge all such facilities as the Council may reasonably require for such inspection and examination. In this Condition, Services includes planning or preliminary work for the Services.

9. Invoices and payment

9.1 The Contractor shall submit an invoice to the Council for the attention of the Central Transactions Unit as specified in the Contract or within 28 days of the completion of the Services. All invoices shall quote the Contract number and, where appropriate, the purchase order number.

9.2 The Contractor shall submit with the invoice such records as the Council may reasonably require including, but not limited to time sheets, expenses incurred, invoices paid or any other documents which would enable the Council to verify the information and the amounts referred to in that invoice.

9.3 The Contractor shall provide to the Council the name and address of his bank, the account name and number, the bank sort code and any other details, in whatever format the Council may require.

9.4 The Council shall pay the Contractor in respect of the satisfactory performance of the Services in accordance with the Contract.

9.5 Except where otherwise provided in the Contract, the amount payable to the Contractor for the performance of the Services shall be inclusive of all costs of staff, facilities, equipment, materials and all other expenses whatsoever incurred by the Contractor in discharging his obligations under the Contract.

9.6 The Council is committed to prompt payment in accordance with statutory legislation and shall pay the Contractor within 30 days of the receipt of a valid invoice, provided that the Council is satisfied that the Services for which the invoice relates have been performed fully in accordance with the Contract.

9.7 The Contractor shall be bound by the Council’s Standing Order 67 and Financial Regulation H.

9.8 The Contract is on a fixed price basis and does not allow for variation of pricing except in respect of VAT.

10. Value added tax

The Council shall pay to the Contractor the amount of any VAT chargeable in respect of the performance of the Services in accordance with Contract.

11. Corrupt gifts and payments of commission

11.1 The Contractor shall not receive or agree to receive from any person, or offer or agree to give to any person, or procure for any person any gift or consideration of any kind as an inducement or reward for doing or not doing anything, or for showing favour or disfavour to any person in relation to the Contract or any other contract with the Crown.

11.2 The Contractor shall not conspire with any person to do any of the acts mentioned in Condition 11.1.

11.3 Any:-
(a) breach by the Contractor of this Condition; or
(b) commission of any offence by the Contractor under the Prevention of Corruption Acts 1889 to 1916 or Sections 46 to 47 of the Local Government Act (NI) 1972 in relation to this or any other contract with the Council; shall entitle the Council to terminate the Contract and recover from the Contractor the amount of any loss resulting from such termination and recover from the Contractor the amount of value of any such gift, consideration or commission.

11.4 The decision of the Council in relation to this Condition shall be final and conclusive.

12. The Fair Employment and Treatment (NI) Order 1998

12.1 The Contractor shall not be an unqualified person for the purposes of Section 64 to 66 of the fair Employment and Treatment (NI) Order 1998 and shall sign the Declaration and Undertaking annexed hereto.

12.2 The Contractor shall not sub-contract any Services or Work to an unqualified person for the purposes of Section 64 to 66 of the Fair Employment and Treatment (NI) Order 1998.

13. Disclosures of information

13.1 The Council reserves the general right to disclose information about this Contract to other Government agencies, Government Departments, District Councils, Local Enterprise Agencies or other bodies involved in Economic Development in the European Union, unless otherwise agreed in writing. Belfast City Council shall also be entitled to include any such information in a database of economic, financial and statistical information and to publish or disseminate relevant reports.

13.2 DETI and Belfast City Council shall be entitled to publish details of the value and type of contract awarded and in such manner as they decide.

13.3 The Contractor shall not disclose the Contract or any provision thereof or any information resulting from, in connection with, or during the course of, the Contract, to any person unless it is strictly necessary for the performance of the Contract, and authorised in writing by the Council. The Contractor shall comply with any instructions regarding changes to authorisations and other instructions regarding disclosure or non-disclosure. This Condition does not apply in relation to information (a) which is in or enters the public domain otherwise than by a breach of an obligation of confidentiality (b) which is or becomes known from other sources without
breach of any restriction on disclosure or (c) which is required to be disclosed by law or any professional or regulatory obligation.

13.4 Subject to Condition 13.3, the Contractor shall ensure that information about the Contract, or arising from or connected with the Contract:-
(a) is divulged only to the minimum number of persons;
(b) is divulged only to the extent essential to each person's action in carrying out (or in connection with) the Contract and that such persons do not further divulge such information;
(c) is properly safeguarded.

13.5 Subject to the retention of proper professional records, the Contractor shall, on written  request from the Council, return all documents containing any part of the Work carried out by the Contractor, including but not limited to, documents stored electronically.

13.6 The Contractor shall ensure that any contract with:-
(a) any employee of his, and
(b) any contractor of his engaged in any way in connection with the Contract,
contains a condition requiring that person to keep all information in relation to the Contract and its performance confidential, and shall draw their attention to the requirements of this condition and condition 13.2.

13.7 No information regarding the Services being provided under the Contract or facilities to photograph or film shall be given or permitted by the Contractor except with prior written permission of the Council, to whom any press or other enquiry or any such matter should be referred. This Condition does not apply in relation to information
(a) which is in or enters the public domain otherwise than by a breach of an obligation of confidentiality
(b) which is or becomes known from other sources without breach of any restriction on disclosure or
(c) which is required to be disclosed by law or any professional or regulatory obligation.

13.8 The Contractor shall not, in connection with the Contract, communicate with representatives of the general or technical press, radio, television or other communications media unless specifically granted permission to do so in writing by the Council. 

13.9 Except with the consent in writing of the Council the Contractor shall not make use of the Contract or any information issued or furnished by or on behalf of the Council otherwise than for the purpose of the Contract.

13.10 The decision of the Council regarding anything in this Condition 13 shall be final and conclusive.

14. Discrimination

The Contractor shall not unlawfully discriminate within the meaning and scope of the provisions of the Race Relations (NI) Order 1997, Sex Discrimination (NI) Order 1976 (as amended), Fair Employment and Treatment (NI) Order 1998 and the Disability Discrimination Act 1995 and shall take all reasonable steps to ensure that all servants, employees or agents of the Contractor and all sub-contractors employed in the execution of the Contract do not unlawfully discriminate.

This condition shall not in any way relieve the Contractor of his general obligations to comply with any legislative requirements as provided in Condition 5.

15. Merger, take-over or change of control

The Contractor shall forthwith inform the Council in writing of any proposal or negotiations which may or will result in a merger, take-over, change of control, change of name or status, or the Contractor (being a company as defined in the Companies (NI) Order 1986-1990) shall inform the Council of any such change as defined in section 416 of the Income and Corporation Taxes Act 1988. The Contractor shall comply with any request by the Council for information arising from this Condition.

16. Unsatisfactory performance

16.1 Where in the opinion of the Council the Contractor has failed to perform the whole or any part of the Services, with the standard of skill, care and diligence which a competent and suitably qualified person performing the same Services could reasonably be expected to exercise, or in accordance with the Contract (including the Specification and Programme), the Council may give the Contractor a notice specifying the way in which his performance falls short of the requirements of the Contract, or is otherwise unsatisfactory.

16.2 Where the Contractor has been notified of a failure in accordance with Condition 16.1 the Council may:
(a) request from the Contractor that, at his own expense and as specified by the Council, he reschedules and performs the Services to the Council's satisfaction within such period as may be specified by the Council in the notice, including where necessary, the correction or re-execution of any Services already carried out; or
(b) withhold or reduce payments to the Contractor, in such amount as the Council deems appropriate in each particular case.

17. Termination of the contract

Without prejudice to any other power of termination, the Council may terminate the Contract without notice, for any of the following reasons:-
(a) the breach by the Contractor of any of Conditions 11 (Corrupt Gifts & Payments of Commission), 12 (Fair Employment and Treatment (NI) Order 1998), 13 (Disclosure of Information) of the Contract, or any other material breach of contract;
(b) the failure by the Contractor to comply with a notice given under Condition 16 (Unsatisfactory Performance)within 14 days from the date of the notice;
(c) the Contractor ceases or proposes to cease to carry on his business;
(d) there is a change of control of the type referred to in Condition 15 (Merger, Take-over or Change of Control), and the Council has not agreed in advance in writing to the particular change of control, save that in this event the Council shall give one month's notice in writing to the Contractor.

18. Break

The Council shall in addition to its powers under any other of these Conditions have power to terminate the Contract at any time by giving to the Contractor one month's written notice. Upon the expiry of the notice the Contract shall be terminated without prejudice to the rights of the parties accrued to the date of termination.

19. Consequences of termination and break

19.1 Where the Contract is terminated under Condition 17 (Termination of the Contract), the following provisions shall apply:-
(a) Any sum due or accruing from the Council to the Contractor may be withheld or reduced by such amount as the Council in either case considers reasonable and appropriate in the circumstances;
(b) the Council may make all arrangements which are in its view necessary to procure the orderly completion of the Services including the letting of another contract or contracts;
(c) where the total costs reasonably and properly incurred by the Council by reason of such arrangements exceed the amount that would have been payable to the Contractor for the completion of the Services, the excess shall, subject to any overall limitation of liability contained in condition 22, be recoverable from the Contractor and the Council reserves the right to recover such excess by set-off against any amount withheld by the Council under Condition 19.1 (a) or as otherwise provided for under Condition 25 (Recovery of Sums Due).

19.2 Without prejudice to Condition 19.1, where the Contract is terminated under Condition 17 (d) or Condition 18 (Break), the Contractor shall have the right to claim from the Council reimbursement of all reasonable costs necessarily and properly incurred by him in relation to the orderly cessation of the Services, including any commitments, liabilities or expenditure which are reasonably and properly incurred, and would otherwise represent an unavoidable loss by the Contractor by reason of the termination of the Contract. For the avoidance of doubt the Council will not indemnify the Contractor against loss of profit.

The Council shall not in any case be liable to pay under the provisions of this Condition any sum which, when taken together with any sums paid or due or becoming due to the Contractor under the Contract, shall exceed the total Contract price.

19.3 Where the Contract is terminated under Condition 17 (Termination of the Contract) or Condition 18 (Break), the Council may, during any notice period:-
(a) direct the Contractor, where the Services have not been commenced, to refrain from commencing such Services or where the Services have been commenced, to cease work immediately; 
(b) direct the Contractor to complete in accordance with the Contract all or any of the Services, or any part or component thereof, which shall be paid at the agreed Contract Price or, where no agreement exists, a fair and reasonable price. 

20. Assignment, sub-contractors and suppliers

20.1 The Contractor shall not sub-contract or transfer, assign, charge, or otherwise dispose of the Contract or any part of it without the prior written consent of the Council.

20.2 The Contractor shall ensure that any sub-contractor complies with the terms and conditions of the Contract, so far as they are applicable. Any sub-contract shall not relieve the Contractor of his obligations under the Contract. 

20.3 Where the Contractor enters into a contract with a supplier or sub-contractor for the purpose of performing the Contract or any part of it, he shall cause a term to be included in such contract which requires payment to be made by the Contractor to the supplier or subcontractor within a specified period not exceeding 30 days from receipt of a valid invoice as defined by the Contract requirements.

21. Insurance

21.1 The Contractor shall effect and maintain insurance necessary to cover his liabilities under the Contract and, where the Contractor sub-contracts part of the Contract, he shall procure that any such sub-contractor effects and maintains insurance to cover its liabilities under the subcontract.

21.2 Where in compliance with Condition 21.1 the Contractor effects, or is to procure that a sub-contractor effects, professional indemnity insurance, the requisite insurance shall cover liabilities under the Contract, or sub-contract as the case may be, from the commencement of the Services, or the services under the sub-contract as the case may be, until 6 years after: 
(i) the completion of the Services; or
(ii) the termination of the Contract
whichever is the earlier.

21.3 The Contractor shall, whenever required by the Council, produce to the Council documentary evidence showing that the insurance required by Conditions 21.1 and 21.2 has been taken out and is being maintained.

21.4 If, for whatever reason, the Contractor fails to maintain, or fails to procure that any subcontractor  maintains, the insurance required by this Condition 21, the Council may make alternative arrangements necessary to protect its interests and recover the costs thereof from the Contractor, provided always that any overall limitation of liability contained in Condition 22 shall not thereby be exceeded.

21.5 The terms of any insurance or the amount of cover shall not relieve the Contractor or his sub-contractors or consultants of any liabilities under the Contract, their sub-contracts or their terms of commission.

21.6 Without prejudice to any rights or remedies of the Council (including the Council’s rights and remedies under the Contract) the Contractor shall indemnify the Council against all actions, suits, claims, demands, losses, charges, costs and expenses which the Council or any third party may suffer or incur as a result of or in connection with any damage to property or in respect of any injury (whether fatal or otherwise) to any person or in respect of any consequential loss which may result directly or indirectly from the provision of the service or the negligent or wrongful act or omission of the Contractor.

21.7 The Contractor shall effect with a reputable insurance company a policy or policies of insurance at the level stated in the Schedule hereto covering the matters which are the subject of indemnities under these conditions and shall at the request of the Council produce the relevant policy or policies together with receipts or other evidence of payment of the latest premium due thereunder.

22. Loss or damage

22.1 Condition 22 applies to any loss or damage which arises out of or is in any way connected with the performance of the Contract and shall include, for the avoidance of doubt and without prejudice to the generality of the foregoing, breaches of Conditions 26.1, 28 and 34.

22.2 The Contractor shall, without delay and at his own expense, replace or make good to the satisfaction of the Council, or, if the Council requires, compensate the Council for, any loss or damage.

22.3 If any loss or damage:-
(a) was not caused or contributed to by the Contractor's neglect or default, whether by act, omission or otherwise (for the purposes of this condition 22.3, "Contractor" shall include his servants, agents or sub-contractors) , he shall be under no liability under this condition 22;
(b) was in part caused or contributed to by the Contractor's neglect or default, whether by act, omission or otherwise, and in part by:-
(i) the act, neglect or default of any other person; and/or
(ii) circumstances outside both the Contractor's control and his reasonable contemplation the Contractor’s liability under this condition 22 shall, except in relation to any loss or damage arising out of the Contractor's fraud or breach of condition 11 or 12 (to which this condition 22.4(b) shall not apply), be limited to the proportion of the loss or damage which it is just and equitable for the Contractor to pay. 

22.4 In this condition 22 loss or damage includes:-
(a) loss or damage to property;
(b) personal injury and death;
(c) loss of profit or loss of use;
(d) any other loss.

23. Confidentiality

23.1 Each Party:-
(a) shall treat all Confidential Information belonging to the other Party as confidential and safeguard it accordingly; and 
(b) shall not disclose any Confidential Information belonging to the other Party to any other person without the prior written consent of the other Party, except to such persons and to such extent as may be necessary for the performance of the Contract or except where disclosure is other wise expressly permitted by the provisions of this Contract. 

23.2 The Contractor shall take all necessary precautions to ensure that all Confidential Information obtained from the Council under or in connection with the Contract:-
(a) is given only to such of the Staff and professional advisors or consultants engaged to advise it in connection with the Contract as is strictly necessary for the performance of the Contract and only to the extent necessary for the performance of the Contract;
(b) is treated as confidential and not disclosed (without prior Council approval) or used by any Staff or such professional advisors or consultants otherwise than for the purposes of the Contract; 

23.3 The Contractor shall ensure that Staff or its professional advisors or consultants are aware of the Contractor’s Confidentiality obligations under this Contract.

23.4 The Contractor shall not use any Confidential Information it receives from the Council otherwise than for the purposes of the Contract. 

23.5 The provisions of Clauses 23.1 to 23.4 shall not apply to any Confidential Information received by one Party from the other:-
(a) which is or becomes public knowledge (otherwise than by breach of this Condition);
(b) which was in the possession of the receiving Party, without restriction as to its disclosure, before receiving it from the disclosing Party;
(c) which is received from a third party who lawfully acquired it and who is under no obligation restricting its disclosure;
(d) which is independently developed without access to the Confidential Information; or (e) which must be disclosed pursuant to a statutory, legal or parliamentary obligation placed upon the Party making the disclosure, including any requirements for disclosure under the FOIA, or the Environmental Information Regulations pursuant to Condition 24.3 (Freedom of Information).

23.6 Nothing in this Condition shall prevent the Council:

  • (a) disclosing any Confidential Information for the purpose of:
    • (i) the examination and certification of the Council’s accounts; or
    • (ii) any examination pursuant to Section 6(1) of the National Audit Act 1983, or any other Statutory provision, of the economy, efficiency and effectiveness with which the Council has used its resources; or
  • (b) disclosing any Confidential Information obtained from the Contractor:
    • (i) to any government department or any other Contracting Authority. All government departments or Contracting Authorities receiving such Confidential Information shall be entitled to further disclose the Confidential Information to other government departments or other Contracting Authorities on the basis that the information is confidential and is not to be disclosed to a third party which is not part of any government department or any Contracting Authority; or
    • (ii) to any person engaged in providing any services to the Council for any purpose relating to or ancillary to the Contract:

provided that, in disclosing information under sub-paragraph (b), the Council discloses only the information which is necessary for the purpose concerned and requires that the information is treated in confidence and that a confidentiality undertaking is given where appropriate.

23.7 Nothing in this Condition shall prevent either Party from using any techniques, ideas or know-how gained during the performance of the Contract in the course of its normal business, to the extent that this does not result in a disclosure of Confidential Information or an infringement of Intellectual Property Rights. 

23.8 In the event that the Contractor fails to comply with this Condition 23, the Council reserves the right to terminate the Contract by notice in writing with immediate effect.

24. Freedom of information

24.1 The Contractor acknowledges that the Council is subject to the requirements of the FOIA and the Environmental Information Regulations and shall assist and co-operate with the Council (at the Contractor’s expense) to enable the Council to comply with these Information disclosure requirements. 

24.2 The Contractor shall and shall procure that its sub-contractors shall:

  • (a) transfer the Request for Information, as defined in the FOIA or the Environmental Information Regulations, to the Council as soon as practicable after receipt and in any event, within [two] Working Days of receiving a Request for Information:
  • (b) provide the Council with a copy of all Information in its possession or power in the form that the Council requires within [five] Working Days (or such other period as the Council may specify) of the Council requesting that Information; and
  • (c) provide all necessary assistance as reasonably requested by the Council to enable the Council to respond to a Request for Information within the time for compliance set out in section 10 of the FOIA [or regulation 5 of the Environmental Information Regulations].

24.3 The Council shall be responsible for determining at its absolute discretion whether the Commercially Sensitive Information and/or any other information:

  • (a) is exempt from disclosure in accordance with the provisions of the FOIA or the Environmental Information Regulations;
  • (b) is to be disclosed in response to a Request for Information, and in no event shall the Contractor respond directly to a Request for Information, unless expressly authorised to do so by the Council;

24.4 The Contractor acknowledges that the Council may be obliged under the FOIA, or the Environmental Information Regulations, or any regulations or guidelines made thereunder, to disclose Information:

  • (a) without consulting with the Contractor, or
  • (b) following consultation with the Contractor and having taken its views into account.

24.5 The Contractor shall ensure that all information produced in the course of the Contract or relating to the Contract is retained for disclosure and shall permit the Council to inspect such records as requested from time to time.

24.6 The Contractor acknowledges that any lists or schedules provided by it outlining Confidential Information or Commercially Sensitive Information are of indicative value only and that the Council may nevertheless be obliged to disclose Confidential Information or Commercially Sensitive Information in accordance with Clause 24.4.

25. Recovery of sums due

Whenever under the Contract any sums of money shall be recoverable from or payable by the Contractor to the Council, the same may be deducted from any sum then due, or which at any later time may become due, to the Contractor under the Contract or under any other contract with the Council.

26. Data protection

The Contractor shall take such technical and organisational measures as are necessary to comply with the General Data Protection Regulation and the Data Protection Act 2018.

27. Insolvency of the contractor

27.1 The Contractor shall inform the Council:

  • (a) if being an individual, or where the Contractor is a firm, any partner in that firm, shall at any time become bankrupt, or shall have a receiving order or administration order made against him, or shall make any composition or arrangement with or for the benefit of his creditors, or shall make any conveyance or assignment for the benefit of his creditors, or shall purport to do so, or if in Scotland he shall become insolvent or notour bankrupt, or any application shall be made under any bankruptcy Act for the time being in force for  sequestration of his estate, or a trust deed shall be granted by him for the benefit of his creditors; or
  • (b) if being a company, he passes a resolution, or the Court makes an order, that the company be wound up otherwise than for the purpose of reconstruction or amalgamation, or if a receiver or manager on behalf of a creditor shall be appointed, or if circumstances shall arise which entitle the Court, otherwise than for the purposes of amalgamation or reconstruction, to make a winding-up order.

27.2 If any of the events in the conditions 27.1 (a) or 27.1 (b) occur (whether or not the Contractor has informed the Council) the Council may at any time by notice in writing summarily terminate the Contract without compensation to the Contractor. Such termination shall not prejudice or affect any right of action or remedy which shall have accrued before that date or shall accrue thereafter to the Council.

28. Royalties and licence fees

The Contractor shall ensure that all royalties, licence fees or similar expenses in respect of all intellectual property used in connection with the Contract have been paid and are included within the Contract Price.

29. Drawings, specifications, software, designs and other data

Any drawings, specification, software, designs or other data (including working documents, maps and photographs) completed or provided in connection with the Contract shall become or, as the case may be, remain the property of the Council and be delivered up to the Council on completion or termination of the Contract, subject to the retention of proper professional records.

Where the Council has agreed to accept modern storage media, drawings and other documents shall be supplied by the Contractor in an agreed form.

30. Retention of documentation

The Contractor shall retain, produce when required (and explain as necessary) such accounts, documents (including working documents) and records as the Council, or the Contract Manager, may request, in connection with the Contract, at any time during the Contract and until 31 December 2022 or such longer period as may be required by the Council and notified in writing to the Contractor before the 31 December 2022 deadline and afford such facilities as the Council may reasonably require for his representatives to visit the Contractor's premises and examine the records under this Condition. In the event of termination of the project for any reason, the full documentation must be returned to Belfast City Council or placed in appropriate storage
facilities approved by Belfast City Council.

31. Serving of notices

Any notice required to be given or served under this Contract by the Council shall be in writing and shall be served by either:-
(a) delivery to the Contractor's Representative, or
(b) sending it by first-class post to the Contractor's last known place of business or registered office, when it shall be deemed to be served on the day when in the ordinary course of the post it would have been delivered. Any notice required to be given by the Contractor to the Council shall be sent to the Chief Executive of the Council.

32. Arbitration

All disputes, differences or questions between the parties to the Contract with respect to any matter or thing arising out of or relating to the Contract (other than a matter or thing as to which the decision of the Council is under the Contract to be final and conclusive, and except to the extent to which special provision for arbitration is made elsewhere in the Contract), shall be referred to either:-

  • (a) the arbitration of 2 persons, one to be appointed by the Council and one by the Contractor, or
  • (b) their Umpire in accordance with the provisions of the Arbitration Acts 1950, 1996 or any statutory modification or re-enactment thereof for the time being in force.

33. Transfer of responsibility

33.1 In the event that a different organisation is required to take over the Services at the expiry or termination of the Contract, the Contractor shall co-operate in the transfer, under arrangements to be notified to him by the Council.

33.2 The transfer shall be arranged between the Council and the Contractor so as to reduce to a minimum any interruption in the Services. 

34. Contractor's obligations in connection with TUPE

34.1 Where requested to do so the Contractor shall provide such information (including any changes to and interpretations thereof) in connection with The Transfer of Undertakings (Protection of Employment) Regulations 1981 (TUPE), as the Council may require, to the Council and/or to any other person authorised by the Council who is to be invited to submit a tender in relation to the provision of similar Services, within 10 days of the request.

34.2 During the 8 month period preceding the expiry of this Contract or within any period of notice of Termination or notice of Break, the Contractor shall not without the prior written agreement of the Council, which shall not be unreasonably withheld or delayed:
(a) materially amend the terms and conditions of employment of any employee whose work, wholly or mainly falls within the scope of this Contract; or
(b) materially increase the number of employees whose work (or any part of it) is work undertaken for the purposes of this Contract.

34.3 The Contractor shall not knowingly do or omit to do anything which may adversely affect an orderly transfer of responsibility for provision of the Services.

35. Use of council facilities

The Council shall make available to the Contractor all facilities under the Council’s control and information and give such assistance as shall reasonably be required for the carrying out by the Contractor of the services under the contract.

36. Severability

If any provision of the Contract is held invalid, illegal or unenforceable for any reason by any court of competent jurisdiction, such provision shall be severed and the remainder of the provisions of the Contract shall continue in full force and effect as if the Contract had been executed with the invalid, illegal or unenforceable provision eliminated. In the event of a holding of invalidity so fundamental as to prevent the accomplishment of the purpose of the Contract, the Council and the Contractor shall immediately commence negotiations in good faith to remedy the invalidity.

37. Waiver

37.1 The failure of the Council or the Contractor to exercise any right or remedy shall not constitute a waiver of that right or remedy.

37.2 No waiver shall be effective unless it is communicated to either the Council or the Contractor in writing.

37.3 A waiver of any right or remedy arising from a breach of contract shall not constitute a waiver of any right or remedy arising from any other breach of the Contract.

38. Rights of third parties

Nothing in this Contract confers or purports to confer on any third party any right to enforce any term of this Contract.

39. Publicity 

The contractor should ensure compliance with the publicity guidance. EC Council Regulation No 1083/2006 requires that all EU co-financed programme schemes should be transparent and publicised to the beneficiaries and the general public. The overall aim of publicity is to highlight and promote the role played by the European Union, specifically the European Sustainable Competitiveness Programme, in supporting projects in Northern Ireland. Both the Belfast City Council and the European Regional Development Fund logos must be used on all programme documentation and are available on request. Further guidance on publicity will be provided on request. 

Standing order 67 - engagement of consultants

67 (a) It shall be a condition of the engagement of any architect, engineer, surveyor or other consultant (who is not an officer of the Council) who is retained to supervise a contract
on behalf of the Council that he/she will -
 (i) comply with these Standing Orders;
 (ii) produce for inspection to the Chief Officer on request all records kept by him/her in relation to the contract.

Financial regulation H - orders for work, goods and services

H.1 Official orders shall be in a form approved by the Director of Finance and Resources and are to be signed only by officers authorised by the appropriate Chief Officer.

H.2 Each Chief Officer shall be responsible for all orders emanating from his/her Department and shall be responsible for ensuring that sufficient provision is available in the approved estimates for the expenditure.

H.3 Official orders shall be issued for all work, goods or services to be supplied to the Council, except for supplies of public utility services, for periodic payments such as rent or rates, for petty cash purchases or such other exceptions as the Director of Finance and Resources may approve.

H.4 Each order shall conform with the directions of the Council with respect to central purchasing and the standardisation of supplies and materials.

H.5 A copy of each order shall, if so required, be supplied to the Director of Finance and Resources.

H.6 Chief Officers shall acquire official order forms in accordance with arrangements approved by the Director of Finance and Resources, and be responsible for their control and use.

H.7 Where urgent orders are given orally, they shall be confirmed by a written official order within 2 working days.

H.8 No order may be given unless the expenditure that will arise from it is in accordance with Standing Orders and Financial Regulations.

H.9 The Standing Orders relating to contracts have been made by the Council under the terms of Section 99 of the Local Government Act (Northern Ireland) 1972 and are therefore of statutory effect and their terms must be carefully observed.

The following additional arrangements relating to the invitation of quotations have been agreed with the Local Government Auditor and will be amended from time to time:

  • Where the cost does not exceed £3,000, written quotations need not be invited; where it does not exceed £8,000, three quotations and, where it exceeds £8,000 but not £30,000, four quotations should be invited. These are minimum requirements. It may well be advisable to seek quotations in excess of the number specified, or to advertise where this step appears likely to attract lower prices.
  • In all cases the accepted quotation, together with a summary of all quotations received must be sent to the Director of Finance and Resources when the account is submitted for payment. Where (a) it is proposed to accept a quotation other than the lowest, or (b) the specified number of quotations has not been invited, or (c) the expenditure is not of a normal everyday nature, then the circumstances should be reported in writing to the Director of Finance and Resources. 

 Annex A - Part 1: Generic Standard UK GDPR Clauses

Customer: [to be completed as appropriate]
Contractor: [to be completed as appropriate]
Party: a Party to this Agreement
Agreement: this contract
Law: means any law, subordinate legislation within the meaning of Section 21(1) of the Interpretation Act 1978, bye-law, regulation, order, regulatory policy, mandatory guidance or code of practice, judgement of a relevant court of law, or directives or requirements with which the Processor is bound to comply
Processor Personnel: means all directors, officers, employees, agents, consultants and contractors of the Processor and/or of any Sub-Processor engaged in the performance of its obligations under this Agreement]


Data Protection Legislation: (i) all applicable UK law relating to the processing of personal data and privacy, including but not limited to the UK GDPR, and the Data Protection Act 2018 to the extent that it relates to processing of personal data and privacy; and (ii) (to the extent that it may be applicable) the EU GDPR). The UK GDPR and EU GDPR are defined in section 3 of the Data Protection Act 2018.

Data Protection Impact Assessment: an assessment by the Controller carried out in accordance with Section 3 of the UK GDPR and sections 64 and 65 of the DPA 2018. Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Data Protection Officer take the meaning given in the UK GDPR. Data Loss Event: any event that results, or may result, in unauthorised access to Personal Data held by the Processor under this Agreement, and/or actual or potential loss and/or destruction of Personal Data in breach of this Agreement, including any Personal Data Breach.

Data Subject Request: a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to Data Protection Legislation to access their Personal Data.

DPA 2018: Data Protection Act 2018 UK

GDPR: the UK General Data Protection Regulation

Joint Controllers: takes the meaning given in Article 26 of the UK GDPR

Law Enforcement Processing: processing under Part 3 of the DPA 2018.

Protective Measures: appropriate technical and organisational measures designed to ensure compliance with obligations of the Parties arising under Data Protection Legislation and this Agreement, which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the such measures adopted by it including those outlined in Schedule 1 (Security).

Sub-processor: any third Party appointed to process Personal Data on behalf of that Processor related to this Agreement


1.1 The Parties acknowledge that for the purposes of Data Protection Legislation, the Customer is the Controller and the Contractor is the Processor. The only processing that the Processor is authorised to do is listed in Schedule [X] by the Controller and may not be determined by the Processor. The term “processing” and any associated terms are to be read in accordance with Article 4 of the UK GDPR.

1.2 The Processor shall notify the Controller immediately if it considers that any of the Controller's instructions infringe Data Protection Legislation.

1.3 The Processor shall provide all reasonable assistance to the Controller in the preparation of any Data Protection Impact Assessment prior to commencing any processing. Such assistance may, at the discretion of the Controller, include: (a) a systematic description of the envisaged processing operations and the purpose of the processing; (b) an assessment of the necessity and proportionality of the processing operations in relation to the Services; (c) an assessment of the risks to the rights and freedoms of Data Subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.

1.4 The Processor shall, in relation to any Personal Data processed in connection with its obligations under this Agreement:

(a) process that Personal Data only in accordance with Schedule 1, unless the Processor is required to do otherwise by Law. If it is so required the Processor shall promptly notify the Controller before processing the Personal Data unless prohibited by Law; (b) ensure that it has in place Protective Measures, which are appropriate to protect against a Data Loss Event, which the Controller may reasonably reject. In the event of the Controller reasonably rejecting Protective Measures put in place by the Processor, the Processor must propose alternative Protective Measures to the satisfaction of the Controller. Failure to reject shall not amount to approval by the Controller of the adequacy of the Protective Measures. Protective Measures must take account of the: (i) nature of the data to be protected; (ii) harm that might result from a Data Loss Event; (iii) state of technological development; and (iv) cost of implementing any measures; (c) ensure that : (i) the Processor Personnel do not process Personal Data except in accordance with this Agreement (and in particular Schedule 1); (ii) it takes all reasonable steps to ensure the reliability and integrity of any Processor Personnel who have access to the Personal Data and ensure that they: (A) are aware of and comply with the Processor’s duties under this clause; (B) are subject to appropriate confidentiality undertakings with the Processor or any Sub-processor; (C) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third Party unless directed in writing to do so by the Controller or as otherwise permitted by this Agreement; and (D) have undergone adequate training in the use, care, protection and handling of Personal Data; and (d) not transfer Personal Data outside of the UK unless the prior written consent of the Controller has been obtained and the following conditions are fulfilled: (i) the destination country has been recognised as adequate by the UK government in accordance with Article 45 UK GDPR or section 74 of the DPA 2018; (ii) the Controller or the Processor has provided appropriate safeguards in relation to the transfer (whether in accordance with UK GDPR Article 46 or section 75 DPA 2018) as determined by the Controller; (iii) the Data Subject has enforceable rights and effective legal remedies; (iv) the Processor complies with its obligations under Data Protection Legislation by providing an appropriate level of protection to any Personal Data that is transferred (or, if it is not so bound, uses its best endeavours to assist the Controller in meeting its obligations); and (v) the Processor complies with any reasonable instructions notified to it in advance by the Controller with respect to the processing of the Personal Data; (e) at the written direction of the Controller, delete or return Personal Data (and any copies of it) to the Controller on termination of the Agreement unless the Processor is required by Law to retain the Personal Data.

1.5 Subject to clause 1.6, the Processor shall notify the Controller immediately if it: (a) receives a Data Subject Request (or purported Data Subject Request); (b) receives a request to rectify, block or erase any Personal Data; (c) receives any other request, complaint or communication relating to either Party's obligations under Data Protection Legislation; (d) receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement; (e) receives a request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or (f) becomes aware of a Data Loss Event.

1.6 The Processor’s obligation to notify under clause 1.5 shall include the provision of further information to the Controller, as details become available.

1.7 Taking into account the nature of the processing, the Processor shall provide the Controller with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under clause 1.5 (and insofar as possible within the timescales reasonably required by the Controller) including but not limited to promptly providing: (a) the Controller with full details and copies of the complaint, communication or request; (b) such assistance as is reasonably requested by the Controller to enable the Controller to comply with a Data Subject Request within the relevant timescales set out in Data Protection Legislation; (c) the Controller, at its request, with any Personal Data it holds in relation to a Data Subject; (d) assistance as requested by the Controller following any Data Loss Event; (e) assistance as requested by the Controller with respect to any request from the Information Commissioner’s Office, or any consultation by the Controller with the Information Commissioner's Office.

1.8 The Processor shall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Processor employs fewer than 250 staff, unless: (a) the Controller determines that the processing is not occasional; (b) the Controller determines the processing includes special categories of data as referred to in Article 9(1) of the UK GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the UK GDPR; or (c) the Controller determines that the processing is likely to result in a risk to the rights and freedoms of Data Subjects.

1.9 The Processor shall allow for audits of its Data Processing activity by the Controller or the Controller’s designated auditor.

1.10 Each Party shall designate its own data protection officer if required by Data Protection Legislation.

1.11 Before allowing any Sub-processor to process any Personal Data related to this Agreement, the Processor must: (a) notify the Controller in writing of the intended Sub-processor and processing; (b) obtain the written consent of the Controller; (c) enter into a written agreement with the Sub-processor which give effect to the terms set out in this clause 1 such that they apply to the Sub-processor; and (d) provide the Controller with such information regarding the Sub-processor as the Controller may reasonably require.

1.12 The Processor shall remain fully liable for all acts or omissions of any of its Sub-processors.

1.13 The Parties agree to take account of any guidance issued by the Information Commissioner’s Office. The Controller may upon giving the Processor not less than 30 working days’ notice to the Processor amend this agreement to ensure that it complies with any guidance issued by the Information Commissioner’s Office.

Annex A - Part 2: Schedule of Processing Personal Data and Data Subjects (Schedule X)

Schedule [X] Processing Personal Data and Data Subjects

This Schedule shall be completed by the Controller, who may take account of the view of the Processor, however the final decision as to the content of this Schedule shall be with the Controller at its absolute discretion.

  1. The contact details of the Controller’s Data Protection Officer are: [Insert Contact details]
  2. The contact details of the Processor’s Data Protection Officer are: [Insert Contact details]
  3. The Processor shall comply with any further written instructions with respect to processing by the Controller.
  4. Any such further instructions shall be incorporated into this Schedule.
Description Details
Identity of the Controller and Processor The Parties acknowledge that for the purposes of Data Protection Legislation, the Customer is the Controller and the Contractor is the Processor in accordance with Clause 1.1. 
Subject matter of the processing This should be a high level, short description of what the processing is about i.e. its subject matter of the contract. Example: The processing is needed in order to ensure that the Processor can effectively deliver the contract to provide [insert description of relevant service].
Duration of the processing Clearly set out the duration of the processing including dates.
Nature and purposes of the processing Be as specific as possible, but make sure that you cover all intended purposes. The nature of the processing means any operation such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data (whether or not by automated means). The purpose might include: employment processing, statutory obligation, or recruitment assessment.
Type of Personal Data being Processed Examples include: name, address, date of birth, NI number, telephone number, pay, images, or biometric data.
Categories of Data Subject Examples include: Staff (including volunteers, agents, and temporary workers), customers/ clients, suppliers, patients, students/pupils, members of the public, users of a particular website.
International transfers and legal gateway Explain where geographically personal data may be stored or accessed from. Explain the legal gateway you are relying on to export the data e.g. adequacy decision, EU SCCs, UK IDTA. Annex any SCCs or IDTA to this contract.
Plan for return and destruction of the data once the processing is complete Describe how long the data will be retained for, how it will be returned or destroyed.

Annex B: Security

The technical security requirements set out below provide an indication of the types of security measures that might be considered, in order to protect Personal Data. More, or less, measures may be appropriate depending on the subject matter of the contract, but the overall approach must be proportionate. The technical requirements must also be compliant with legislative and regulatory obligations for content and data, such as UK GDPR.

The example technical security requirements set out here are intended to supplement, not replace, security schedules that will detail the total contractual security obligations and requirements that the Processor (i.e. a supplier) will be held to account to deliver under contract. Processors are also required to ensure sufficient ‘flow-down’ of legislative and regulatory obligations to any third party Sub-processors.

External Certifications e.g. Buyers should ensure that Suppliers hold at least Cyber Essentials Plus certification and ISO 27001:2013 certification if proportionate to the service being procured.

Risk Assessment e.g. Supplier should perform a technical information risk assessment on the service supplied and be able to demonstrate what controls are in place to address those risks.

Security Classification of Information e.g. If the provision of the Services requires the Supplier to Process Authority/Buyer Data which is classified as OFFICIAL,OFFICIAL-SENSITIVE or Personal Data, the Supplier shall implement such additional measures as agreed with the Authority/Buyer from time to time in order to ensure that such information is safeguarded in accordance with the applicable legislative and regulatory obligations.

End User devices 

  • The Supplier shall ensure that any Authority/Buyer Data which resides on a mobile, removable or physically uncontrolled device is stored encrypted using a product or system component which has been formally assured through a recognised certification process agreed with the Authority/Buyer except where the Authority/Buyer has given its prior written consent to an alternative arrangement. 
  • The Supplier shall ensure that any device which is used to Process Authority/Buyer Data meets all of the security requirements set out in the NCSC End User Devices Platform Security Guidance. To read NCSC's information, go to Device security guidance (link opens in new window).

Testing e.g. The Supplier shall at their own cost and expense, procure a CHECK or CREST Certified Supplier to perform an ITHC or Penetration Test prior to any live Authority/Buyer data being transferred into their systems. The ITHC scope must be agreed with the Authority/Buyer to ensure it covers all the relevant parts of the system that processes, stores or hosts Authority/Buyer data.

Networking e.g. The Supplier shall ensure that any Authority/Buyer Data which it causes to be transmitted over any public network (including the Internet, mobile networks or un-protected enterprise network) or to a mobile device shall be encrypted when transmitted.

Personnel Security e.g. All Supplier Personnel shall be subject to a pre-employment check before they may participate in the provision and or management of the Services. Such pre-employment checks must include all pre-employment checks which are required by the HMG Baseline Personnel Security Standard or equivalent including: verification of the individual's identity; verification of the individual's nationality and immigration status; and, verification of the individual's employment history; verification of the individual's criminal record. The Supplier maybe required to implement additional security vetting for some roles.

Identity, Authentication and Access Control e.g. The supplier must operate an appropriate access control regime to ensure that users and administrators of the service are uniquely identified. The supplier must retain records of access to the physical sites and to the service.

Data Destruction/Deletion e.g. The Supplier must be able to demonstrate they can supply a copy of all data on request or at termination of the service, and must be able to securely erase or destroy all data and media that the Authority/Buyer data has been stored and processed on.

Audit and Protective Monitoring e.g. The Supplier shall collect audit records which relate to security events in delivery of the service or that would support the analysis of potential and actual compromises. In order to facilitate effective monitoring and forensic readiness such Supplier audit records should (as a minimum) include regular reports and alerts setting out details of access by users of the service, to enable the identification of (without limitation) changing access trends, any unusual patterns of usage and/or accounts accessing higher than average amounts of Authority/Buyer Data. The retention periods for audit records and event logs must be agreed with the Authority/Buyer and documented.

Location of Authority/Buyer Data e.g. The Supplier shall not, and shall procure that none of its Sub-contractors, process Authority/Buyer Data outside the EEA without the prior written consent of the Authority/Buyer and the Supplier shall not change where it or any of its Sub-contractors process Authority/Buyer Data without the Authority/Buyer's prior written consent which may be subject to conditions.

Vulnerabilities and Corrective Action e.g. Suppliers shall procure and implement security patches to vulnerabilities in accordance with the timescales specified in the NCSC Cloud Security Principle 5. Suppliers must ensure that all COTS Software and Third Party COTS Software be kept up to date such that all Supplier COTS Software and Third Party COTS Software are always in mainstream support.

Secure Architecture e.g. Suppliers should design the service in accordance with:

  • NCSC "Security Design Principles for Digital Services"
  • NCSC "Bulk Data Principles"
  • NCSC "Cloud Security Principles"
Read aloud icon Read aloud