Both parties agree to comply with all current data protection legislation including, but not limited to, the Data Protection Act 2018, the General Data Protection Regulation 2016, and any subsequent amendments to them (“Data Protection Legislation”). We shall, in relation to any personal data processed by us in connection with the performance of our obligations under the Contract process that personal data only on your documented written instructions, unless we are required by law to otherwise process that personal data; ensure that we have in place appropriate technical and organizational measures, reviewed and approved by you, to protect against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorized or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymizing and encrypting personal data, ensuring confidentiality, integrity, availability and resilience of our systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organizational measures adopted by us); ensure that all personnel who have access to and/or process personal data are obliged to keep the personal data confidential; and not transfer any personal data outside of the European Economic Area unless your prior written consent has been obtained (by entering into the Contract, you are providing the necessary consent to us) and the following conditions are fulfilled: you or we have provided appropriate safeguards in relation to the transfer; the data subject has enforceable rights and effective legal remedies; we comply with our obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and we comply with reasonable instructions notified to us in advance by you with respect to the processing of the personal data; where agreed assist you, at your cost, in responding to any request from a data subject and in ensuring compliance with your obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators notify you without undue delay on becoming aware of a personal data breach; at your written direction, delete or return personal data and copies of them to you on termination of the Contract unless required by law to store the personal data and maintain complete and accurate records and information to demonstrate our compliance with this clause 8 and immediately inform you if, in our opinion, an instruction infringes the Data Protection Legislation. You consent to us appointing any third party processors of personal data under the Contract. We confirm that we have entered or (as the case may be) will enter with the third party processor into a written agreement incorporating terms which are substantially similar to those set out in this clause .