67.1  General

In relation to all Personal Data:

(a)  the Service Provider shall, at all times, comply with the DPA as a data controller if necessary, including maintaining a valid and up to date registration or notification under the DPA covering the data processing to be performed in connection with the Services; and

(b)  the Service Provider and any sub-contractor shall only undertake processing of Personal Data reasonably required in connection with the Works and/or the Services and shall not transfer any Personal Data to any country or territory outside the EEA.