PROTECTION OF PERSONAL DATA AND CONFIDENTIAL INFORMATION

What’s This Document For?

Here at APM, we don’t generally like anything which isn’t clear and simple, or which smacks of legal jargon.  But sometimes such documents have their place.  In particular, a “serious-looking” document can help remind signatories of the importance of the matter in hand. 
 
This proforma agreement combines data protection and protection of confidential information and is intended for contractors or non-employed staff who might have access to your sensitive information. 

You should get all contractors (eg IT consultants) who might have access to Personal Data to sign this or something similar to protect yourself from breaches of the GDPR. 
If it is not already in their existing contract, this document could be useful to remind Associates that “ownership” of patient data is yours, and that they may not take patients’ data with them when they leave your practice.  Surprising though it may seem, this is a difficult area of contract law. 
Similarly, this agreement will serve to remind your reception staff/cleaners etc to treat sensitive information with care.

How To Use It

Legal documents are full of convoluted sentences designed to cover every possible loophole.  But the language is still English, and if you are happy to do so, just delete the irrelevant bits of this agreement (especially this introductory bit!). 
For example, you might want to delete the whole of the section on Confidential Information (don’t worry that “Confidential Information” will still appear in the list of agreed terms – it’s not going to invalidate the agreement).

If you’re worried you’ll delete something important, just leave the agreement as it is – that’ll be fine.  
The paragraph numbering is in legal style, and is automatic (in Word, anyway).  When you delete stuff, it should keep all the numbers properly sequential – but cast an eye over it.  You know what MS Word is like!
 
Change the bits like this - Contractor/Associate/Receptionist* - to reflect whoever you are doing business with.

Data Protection (Non-Disclosure) Agreement

This Data Protection (Non-Disclosure) Agreement is dated …………………………………………

PARTIES

1.	 [Your name and address] (The Client); and 
2.	[The contractor’s/other party’s name and address] (The “Contractor”/”Associate”/Receptionist”)

BACKGROUND

The Contractor/Associate/Receptionist* is currently or may be retained as an independent consultant by The Client.

The Contractor/Associate/Receptionist* might, in the normal course of the work carried out become privy to personal data relating to customers, patients or staff of The Client, or to Confidential Information relating to The Client’s business. 
The Contractor/Associate/Receptionist* might also be privy to personal data or confidential business data relating to other contractors or consultants.

AGREED TERMS

1.	INTERPRETATION 
1.1.	The following definitions and rules of interpretation in this clause apply in this Agreement unless the context so otherwise:

“GDPR”	Regulation (EU) 2016/679 Of The European Parliament And Of The Council of 27 April 2016;

“ICO”	The UK Information Commissioner’s Office;

“Personal Data”	means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Data Subject”	means the identified or identifiable natural person to whom the Personal Data relates; 
“Personal data breach”	means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;  

“Confidential Information”	All written or oral information disclosed or provided by the Client to the Contractor/Associate/Receptionist* regardless of whether such information was provided before or after the date of this Agreement

2.	AGREEMENT TO PROTECT PERSONAL DATA

2.1.	As a condition of the Client retaining the Contractor/Associate/Receptionist*, the parties to this Agreement agree as follows:  
2.1.1.	The Contractor/Associate/Receptionist* agrees to conduct their business in accordance with the GDPR to the full extent that the Regulation relates to them. 
2.1.2.	The Contractor/Associate/Receptionist* will be responsible for the secure protection of personal data to which they become privy in accordance with the GDPR. 
2.1.3.	The Contractor/Associate/Receptionist* will only use Personal Data to the extent necessary for the services commissioned by The Client. 
2.1.4.	The Contractor/Associate/Receptionist* will not process or alter or erase Personal Data in any way unless agreed by The Client. 
2.1.5.	If a Subject Access Request or data deletion request is made directly to The Contractor/Associate/Receptionist* by a data subject or their representative, The Contractor/Associate/Receptionist*will contact The Client before taking any action. 
2.1.6.	On request from The Client,  The Contractor/Associate/Receptionist*will supply copies of any data supplied to them by The Client or that they have generated based on this. 
2.1.7.	If requested by The Client, The Contractor/Associate/Receptionist* will delete Personal Data as specified by The Client 
2.1.8.	The Contractor/Associate/Receptionist* may not share Personal Data acquired in the course of their business with The Client without the written permission of The Client 
2.1.9.	On completion of The Contractor’s/Associate’s/Receptionist’s* contract with The Client, all confidential data and Personal Data acquired in the course of their business with The Client must be returned to The Client. The Contractor/Associate/Receptionist* will then securely delete all such data held by them or generated by them during the course of their business with The Client. 
2.1.10.	The Contractor/Associate/Receptionist* will immediately report any Data Breach to The Client. 
2.1.11.	The Contractor/Associate/Receptionist* will inform The Client if they become  the subject of any enquiries or proceedings by the ICO. 
2.1.12.	The Contractor/Associate/Receptionist* agrees to cooperate with any data protection audit conducted by The Client

3.	AGREEMENT TO PROTECT CONFIDENTIAL INFORMATION 
3.1.	Except as otherwise provided in this Agreement, Confidential Information will remain the exclusive property of the Client and will only be used by the Contractor/Associate/Receptionist* to the extent necessary to fulfil their contract 
3.2.	The Contractor/Associate/Receptionist* will not use the Confidential Information for any purpose that might be directly or indirectly detrimental to the Client or any associated affiliates or subsidiaries. 
3.3.	The obligations to ensure and protect the confidentiality of the Confidential Information imposed on the Contractor/Associate/Receptionist* in this Agreement will survive the expiration or termination, as the case may be, of this Agreement and those obligations will last indefinitely. 
3.4.	The Contractor/Associate/Receptionist * may disclose Confidential Information:  
3.4.1.	to such employees, agents, representatives and advisors of the Contractor * that have a reasonable need to know for the execution of  The Contractor’s * contract, provided that:  
3.4.1.1.	The Contractor * has informed such personnel of the confidential nature of the Confidential Information; 
3.4.1.2.	such personnel agree to be legally bound to the same burdens of non-disclosure and non-use as the The Contractor *; 
3.4.1.3.	The Contractor * agrees to take all necessary steps to ensure that the terms of this Agreement are not violated by such personnel; and 
3.4.1.4.	The Contractor * agrees to be responsible for and indemnify the Client for any breach of this Agreement by its personnel. 
3.4.2.	to a third party where the Client has consented in writing to such disclosure; and 
3.4.3.	to the extent required by law or by the request or requirement of a court of law, a regulatory body, or an administrative tribunal. 
Remedies

3.5.	The Contractor/Associate/Receptionist * agrees and acknowledges that the Confidential Information is of a proprietary and confidential nature and that any disclosure of the Confidential Information to a third party in breach of this Agreement cannot be reasonably or adequately compensated for in money damages and would cause irreparable injury to the Client. Accordingly, the Contractor/Associate/Receptionist * agrees that the Client is entitled to, in addition to all other rights and remedies available to them at law or in equity, an injunction restraining the Contractor/Associate/Receptionist *, any of its personnel, and any agents of the Contractor/Associate/Receptionist *, from directly or indirectly committing or engaging in any act restricted by this Agreement in relation to the Confidential Information. 
Return of Confidential Information 
3.6.	The Contractor/Associate/Receptionist * agrees that, upon request of the Client, or in the event that the Contractor/Associate/Receptionist * ceases to require use of the Confidential Information, or upon expiration or termination of their contract, the Contractor/Associate/Receptionist * will turn over to the Client all documents, disks or other computer media, or other material in the possession or control of the Contractor/Associate/Receptionist * that: 
3.6.1.	may contain or be derived from ideas, concepts, creations, or trade secrets and other proprietary and Confidential Information as defined in this Agreement; or 
3.6.2.	is connected with or derived from The Contractor’s/Associate’s/Receptionist’s* services to the Client. 
Notices 
3.7.	In the event that the Contractor/Associate/Receptionist * is required in a civil, criminal or regulatory proceeding to disclose any part of the Confidential Information, the Contractor/Associate/Receptionist * will give to the Client prompt written notice of such request so the Client may seek an appropriate remedy or alternatively to waive the Contractor/Associate/Receptionist * compliance with the provisions of this Agreement in regards to the request. 
3.8.	If the Contractor/Associate/Receptionist * loses or makes unauthorised disclosure of any of the Confidential Information, the Contractor/Associate/Receptionist * will immediately notify the Client and take all reasonable steps necessary to retrieve the lost or improperly disclosed Confidential Information. 
3.9.	Any notices or delivery required in this Agreement will be deemed completed when hand-delivered, delivered by agent, or seven (7) days after being placed in the post, postage prepaid, to the parties at the addresses contained in this Agreement or as the parties may later designate in writing. 
3.10.	The addresses for any notice to be delivered to any of the parties to this Agreement are as follows:  
3.10.1.	[Your name and address] 
3.10.2.	[The other party’s name and address] 
Representations 
3.11.	In providing the Confidential Information, the Client makes no representations, either expressly or impliedly as to its adequacy, sufficiency, completeness, correctness or its lack of defect of any kind, including any patent or trade mark infringement that may result from the use of such information. 
TERMINATION 
4.	This Agreement will automatically terminate on the date that The Contractor’s/Associate’s/Receptionist’s* contract with the Client terminates or expires, as the case may be. Except as otherwise provided in this Agreement, all rights and obligations under this Agreement will terminate at that time. 
ASSIGNMENT 
5.	Except where a party has changed its corporate name or merged with another corporation, this Agreement may not be assigned or otherwise transferred by either party in whole or part without the prior written consent of the other party to this Agreement. 
AMENDMENTS 
6.	This Agreement may only be amended or modified by a written instrument executed by both the Client and the Contractor. 
GOVERNING LAW 
7.	This Agreement will be construed in accordance with and governed by the laws of England and Wales/Scotland. 
GENERAL PROVISIONS 
8.	This Agreement may be executed in counterpart. 
9.	Headings are inserted for the convenience of the parties only and are not to be considered when interpreting this Agreement. Words in the singular mean and include the plural and vice versa. Words in the masculine mean and include the feminine and vice versa. 
10.	The clauses, paragraphs, and subparagraphs contained in this Agreement are intended to be read and construed independently of each other. If any part of this Agreement is held to be invalid, this invalidity will not affect the operation of any other part of this Agreement. 
11.	The Contractor/Associate/Receptionist is liable for all costs, expenses and expenditures including, and without limitation, the complete legal costs incurred by the Client in enforcing this Agreement as a result of any default of this Agreement by the The Contractor/Associate/Receptionist*. 
12.	The Client and the The Contractor/Associate/Receptionist acknowledge that this Agreement is reasonable, valid and enforceable. However, if a court of competent jurisdiction finds any of the provisions of this Agreement to be too broad to be enforceable, it is the intention of the Client and the The Contractor/Associate/Receptionist*  that such provision be reduced in scope by the court only to the extent deemed necessary by that court to render the provision reasonable and enforceable, bearing in mind that it is the intention of the The Contractor/Associate/Receptionist* to give the Client the broadest possible protection against disclosure of Confidential Information or Personal Data. 
13.	No failure or delay by the Client in exercising any power, right or privilege provided in this Agreement will operate as a waiver, nor will any single or partial exercise of such rights, powers or privileges preclude any further exercise of them or the exercise of any other right, power or privilege provided in this Agreement. 
14.	This Agreement will inure to the benefit of and be binding upon the respective heirs, executors, administrators, successors and assigns, as the case may be, of the Client and the The Contractor/Associate/Receptionist*. 
15.	This Agreement constitutes the entire agreement between the parties and there are no further items or provisions, either oral or otherwise. 
IN WITNESS WHEREOF [Your Name} and [The Other Party’s Name] have duly affixed their signatures on this date of agreement

  	_______________________________ Your Name 	
  	_______________________________ The Other Party’s Name