89.2  No Disclosure

89.2.1  The Contractor shall not disclose Personal Data to any third parties other than:

(a)  to employees and Sub-Contractors to whom such disclosure is reasonably necessary in order for the Contractor to carry out the Works and/or the Services; or

(b)  to the extent required under a court order,

provided that disclosure under Clause 89.2.1(a) is made subject to written terms substantially the same as, and no less stringent than, the terms contained in this Clause 89.2.1 and that the Contractor shall give notice in writing to the Authority of any disclosure of Personal Data which either the Contractor or a Sub-Contractor is required to make under Clause 89.2.1(b) immediately upon becoming aware of such a requirement.

89.2.2  The Contractor shall bring into effect and maintain all technical and organisational measures to prevent unauthorised or unlawful processing of Personal Data and accidental loss or destruction of, or damage to, Personal Data including to take reasonable steps to ensure the reliability of staff having access to the Personal Data.

89.2.3  The Authority may, at reasonable intervals, request a written description of the technical and organisational methods employed by the Contractor or the Sub-Contractors referred to in Clause 89.2.2.  Within twenty (20) Business Days of such a request, the Contractor shall supply or procure the supply of written particulars of all such measures detailed to a reasonable level such that the Authority can determine whether or not, in connection with the Personal Data, it is compliant with the DPA.