Colchester City Council

Please provide your Data Protection Notification Number. If you are exempt from having to register with the Information Commissioner please explain the reasons why? If you don’t have a registration or don’t know if you need one visit https://ico.org.uk/for-organisations/register/

As the Data Controller, we require confirmation that your organisation will adhere to and ensure continued compliance with the General Data Protection Regulations. This ‘Data Processing Agreement’ will serve as a variation to your existing contract. Please answer the following questions to provide us with the necessary assurance that your policies and procedures comply with the GDPR requirements:

When processing personal data, we will act only on instructions from the Council (unless otherwise required by law).

NoYes

We will ensure any processing of personal information is only that set out in the contract / written instruction that describes the subject matter and duration of the processing, the nature and purposes of the processing, types of personal information and categories of individuals.

NoYes

We will at the choice of the Council delete or return all personal information when the contract ends.

NoYes

We will employ persons who are committed to confidentiality or are under a statutory obligation of confidentiality.

NoYes

We will demonstrate compliance to GDPR and maintain a record of all categories of processing activities

NoYes

We will only subcontract with the prior permission of the Council.

NoYes

We will assist the Council in meeting their obligations under GDPR

NoYes

Will only transfer personal data to a third country (in the absence of an adequacy decision) if the controller or processor has provided appropriate safeguards and on condition that data subjects have enforceable rights in that country with respect to the data.

NoYes

We will ensure ‘appropriate’ security measures are implemented

NoYes

We will notify the Council's Data Protection Officer of any breaches without undue delay after becoming aware of the breach to ensure the Council are able to report the breach within 72 hours

NoYes

For the processing that you undertake under contract for Colchester Borough Council please provide:

A high level summary of the processing that you undertake

Over what length of time are you processing personal data?

The nature and purposes of processing

Categories of personal information / special categories of personal information (For a definition please visit https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ )

Categories of data subject e.g. Staff, customers, clients etc

If you collect personal information on behalf of Colchester Borough Council is this personal information disclosed to anyone other than Colchester Borough Council?

Plan for return and destruction of the data once the processing is complete unless requirement under union or member state law to preserve that type of data

Contact details of person appointed responsibility for data protection within your organisation

Data Processing Agreement - Contractor Compliance Form

What you will need to complete this form

Other important information

Things you will need

Important information