5. Obligations of the Data Importer

Past version: effective from 21/10/2015 - 20/10/2015
To view other versions open the versions tab on the right

The Data Importer agrees and warrants —

(a) to Process the Personal Data only on behalf of the Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reason, it agrees to inform the Data Exporter promptly of its inability to comply, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the Clauses;
(b) that it has no reason to believe in the existence of any non-Abu Dhabi Global Market laws that would have a substantial adverse effect on the enforceability of these Clauses, and it will promptly inform the Data Exporter (which will pass such notification on to the Registrar where required) if it becomes aware of any such laws or any changes in such laws which have such a substantial adverse effect;
(c) that it has implemented the technical and organisational measures specified in Annex B before Processing the Personal Data transferred;
(d) that it will promptly notify the Data Exporter about —
(i) any legally binding request for disclosure of the Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under the criminal law of any jurisdiction outside the Abu Dhabi Global Market to preserve the confidentiality of a law enforcement investigation;
(ii) any accidental or unauthorised access; and
(iii) any request received directly from the Data Subjects without responding to that request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the Data Exporter relating to its Processing of the Personal Data subject to the transfer and to abide by the advice of the Registrar with regard to the Processing of the data transferred;
(f) at the request of the Data Exporter to submit its data Processing facilities for audit of the Processing activities covered by the Clauses which shall be carried out by the Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the Data Exporter, where applicable, in agreement with the Registrar;
(g) to make available to the Data Subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may redact such commercial information, with the exception of Annex B which shall minimally be replaced by a summary description of the security measures in those cases where the Data Subject is unable to obtain a copy from the Data Exporter;
(h) that, in the event of subprocessing, it has previously informed the Data Exporter and obtained its prior written consent;
(i) that the Processing services by the Subprocessor will be carried out in accordance with Clause 11; and
(j) to send promptly a copy of any Subprocessor agreement it concludes under the Clauses to the Data Exporter.