Extract to table

Article 35(1) of the UK GDPR and Article 35(1) of the EU GDPR require that, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data

However, it is identified and documented because the underlying capability exists, and ongoing monitoring is required to ensure that the contractual purpose limitations are respected

• Sub-processor controls (Clause 9): Caldwell must obtain NTP's prior specific authorisation before engaging any sub-processor

• Data subject rights assistance (Clause 10): Caldwell must assist NTP in fulfilling its obligations to respond to data subject requests

(e) Sub-processor approval mechanism: Caldwell must obtain NTP's prior specific written authorisation before engaging any new sub-processor to process NTP data

Caldwell must provide NTP with details of the proposed sub-processor, the scope of processing, the location of processing, and the safeguards to be applied