51.7 For the purpose of the following Clauses, the term "personal data" shall have the meaning given to it in the Data Protection Act 1998.
51.8 Project Co undertakes to the Board that it shall comply with the obligations of a "data controller" under the provisions of the Seventh Data Protection Principle as set out in Schedule 1 of the Data Protection Act 1998. In addition, Project Co:
(a) warrants that it has, or will have at all material times, (and it shall use best endeavours to procure that all Sub-Contractors (and their agents and sub-contractors of any tier have or will have at all material times) the appropriate technical and organisational measures in place against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data held or processed by it and that it has taken, or will take at all material times, all reasonable steps to ensure the reliability of any of its staff which will have access to personal data processed as part of the Project Operations;
(b) undertakes that it will act only on the instructions of the Board in relation to the processing of any personal data made available by or on behalf of the Board as part of the Project Operations;
(c) undertakes that it will only obtain, hold, process, use, store and disclose personal data as is necessary to perform its obligations under this Agreement and (without prejudice to Clause 5.2 (General standards)) that such data will be held, processed, used, stored and disclosed only in accordance with the Data Protection Act 1998 and any other applicable Law; and
(d) undertakes to allow the Board access to any relevant premises on reasonable notice to inspect its procedures described at (a)above.
______________________________________________________________
153 Boards should review the scope of this provision in the light of project specific data processing requirements.