Personal Independence Payment: agency agreement

17. Data Controller Arrangements

17.1 DWP and the Scottish Ministers will be Joint Controllers within the meaning of Article 26 of the UK GDPR.

17.2 It is agreed between the Parties that DWP will administer Personal Independence Payment on the basis of business as usual arrangements as set out under Section 5 of this Agreement.

17.3 The Processing of all Personal Data subject to this Agreement, which is necessary for administering Personal Independence Payment by DWP, will be under DWP’s existing data policies. DWP’s Personal Information Charter can be found via the following link - DWP Personal Information Charter, and it contains more information about how DWP handles/processes Personal Data.

17.4 For the avoidance of doubt, Scottish Ministers’ responsibilities under Article 26(3) of the UK GDPR, will be fulfilled by referring the matter to DWP, which will respond to the Data Subject in accordance with its existing practices.

17.5 DWP in their capacity as a Joint Data Controller, as per this Agreement, will take all reasonable steps to ensure that all Personal Data is up to date and accurate. This will be done in accordance with DWP’s business as usual arrangements as detailed in Section 5 of this Agreement.

17.6 Each party will be responsible for ensuring that their organisation and the data processing they are responsible for is fully compliant with all current Data Protection legislation.