Data Processing Agreement

Forward HR Ltd – The Company/Data Processor           The Client – Data Controller

1. DATA PROTECTION  

    1.1  Both parties will comply with all applicable requirements of the current Data Protection Legislation.

    1.2  The parties acknowledge that for the purposes of the Data Protection Legislation, the Client is the data controller and Forward HR Ltd ‘the Company’ is the data processor. The schedule at the end of this agreement sets out the scope, nature and purpose of processing by the Company, the duration of the processing and the types of personal data.

    1.3  Without prejudice to the generality of clause 1.1, the Client will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Personal Data to the Company for the duration and purposes of this agreement.

    1.4  Without prejudice to the generality of clause 1.1, the Company shall, in relation to any Personal Data processed in connection with the performance by the Company of its obligations under this agreement:

(a)  process that Personal Data only on the written instructions of the Client

(b)  ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);

(c)  ensure that the Personal Data is kept confidential; and

(d)  not transfer any Personal Data outside of the European Economic Area

(e)  assist the Client, at the Client’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

(f)  notify the Client without undue delay on becoming aware of a Personal Data breach;

(g)  at the written direction of the Client, delete or return Personal Data and copies thereof to the Client on termination of the agreement unless required by Applicable Law to store the Personal Data; and

(h)  maintain complete and accurate records and information to demonstrate its compliance

THE SCHEDULE

PROCESSING, PERSONAL DATA AND DATA SUBJECTS

1.  PROCESSING BY THE COMPANY

    1.1  SCOPE  ; The purpose of the Client giving the Company data is to enable HR Consultancy services to be delivered by the Company.

    1.2  DURATION OF THE PROCESSING; The duration of the 12 month contract in place between the parties.

2.  TYPES OF PERSONAL DATA  

Names, length of service, salary, age, sickness records, ethnicity, sexuality, sexual orientation, disability, performance

3.  CATEGORIES OF DATA SUBJECT  

Employees, contractors and job applicants.