{"lejson":"[\n  {\n    \"id\": \"d059927a-5e87-4296-91dc-ad1635b8b3f1\",\n    \"order\": 1,\n    \"text\": \"DATA PROCESSING AGREEMENT\",\n    \"fontSize\": \"20\",\n    \"textAlign\": \"center\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"67e453b6-3a8b-43fa-8cef-11a67e566213\",\n    \"order\": 2,\n    \"text\": \"Controller to processor agreement under Article 28 of the UK General Data Protection Regulation\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"center\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"20\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"f49b6965-4b9f-48fc-a54a-5966e0121e4a\",\n    \"order\": 3,\n    \"text\": \"THIS AGREEMENT is made on <span id='390941aa-adb7-4841-b716-fe87cd3bbb6c'>[date of this agreement]</span>.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"15\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"849278f9-65b0-4457-bc74-2f607b0e404b\",\n    \"order\": 4,\n    \"text\": \"PARTIES\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"083314f4-6b4c-4e52-97fc-6b938c4db72e\",\n    \"order\": 5,\n    \"text\": \"(1) <span id='ef2af697-a2f3-461d-b824-25f6aa08a2b8'>[registered name of the Controller]</span>, an organisation registered under number <span id='a894427c-1d5f-43a8-9066-b733a01824eb'>[registered number of the Controller]</span> in <span id='a3468e59-05de-4b0d-a1ff-4b6cac11f0cd'>[place of registration of the Controller]</span>, whose registered or principal office is at <span id='bc0a732a-1507-45c6-91d8-8e994128b40f'>[registered office of the Controller]</span> (the \\\"Controller\\\"); and\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"3c7306bf-6434-44fd-aeb5-1f9d85bf75dc\",\n    \"order\": 6,\n    \"text\": \"(1) <span id='23862644-5785-4af5-be76-1b5dd9be9778'>[full name of the Controller]</span>, of <span id='7fa8d025-0c13-4f64-8fb4-31a69a1da790'>[address of the Controller]</span> (the \\\"Controller\\\"); and\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"individual\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"2dbbcfdc-31b3-4cea-b8e0-b6c36ca61136\",\n    \"order\": 7,\n    \"text\": \"(2) <span id='9ad97eec-a075-423b-91f3-a10665a5cc0a'>[registered name of the Processor]</span>, an organisation registered under number <span id='8af13ddc-118e-4e42-8243-5449475146c5'>[registered number of the Processor]</span> in <span id='f15f6efd-af8b-47f3-ad54-2dd9494991b1'>[place of registration of the Processor]</span>, whose registered or principal office is at <span id='7d2df7ae-531a-4ca4-af1e-de0f7b72cb3f'>[registered office of the Processor]</span> (the \\\"Processor\\\").\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"232f1649-6ea5-4455-a536-af3194c8233c\",\n    \"order\": 8,\n    \"text\": \"(2) <span id='cf9ae694-66ec-40c0-bcb1-0101abfac742'>[full name of the Processor]</span>, of <span id='efe07007-10d1-4dc5-a772-88da9b551fea'>[address of the Processor]</span> (the \\\"Processor\\\").\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"individual\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"3623758d-79bc-40fd-b044-e17c4f51e09b\",\n    \"order\": 9,\n    \"text\": \"The Controller and the Processor are together the \\\"Parties\\\" and each a \\\"Party\\\".\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"15\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7b221dca-5554-42f8-99be-57db547d47d1\",\n    \"order\": 10,\n    \"text\": \"BACKGROUND\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"5bc6bf42-086b-49e8-9b98-92c56a43bc21\",\n    \"order\": 11,\n    \"text\": \"The Processor provides to the Controller the services described in Annex 1 (the \\\"Services\\\") under an agreement entitled <span id='17330e0c-0f10-4ea1-8177-4979fd676a4c'>[title of the main agreement]</span> dated <span id='0ccf460c-cff0-4d8a-a9f6-b7763c949f3b'>[date of the main agreement]</span> (as amended from time to time, the \\\"Principal Agreement\\\").\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5d213d54-08e8-4e75-945d-8c3f67220e78\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"5b524f06-9e19-4b0d-ad15-5b942dad75a6\",\n    \"order\": 12,\n    \"text\": \"The Processor provides to the Controller the services described in Annex 1 (the \\\"Services\\\") under the arrangements agreed between the Parties for those Services, including any quotation, order form, statement of work or terms of business that apply to them (together, the \\\"Principal Agreement\\\").\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5d213d54-08e8-4e75-945d-8c3f67220e78\",\n        \"value\": \"no\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"517d2658-47df-4c68-95fd-f2536eb9b791\",\n    \"order\": 13,\n    \"text\": \"In providing the Services, the Processor processes personal data on behalf of the Controller. The Parties enter into this Agreement to meet the requirements of Article 28 of the UK GDPR and to set out their respective rights and obligations in relation to that processing.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"422b7194-ecb3-4f8e-9911-b4effa297ec6\",\n    \"order\": 14,\n    \"text\": \"IT IS AGREED as follows:\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"406a9ee0-2369-4a76-be27-648becd93d84\",\n    \"order\": 15,\n    \"text\": \"<span id='42b2c260-cd5c-4e43-a89a-a6b3f241947c'>1</span>. DEFINITIONS AND INTERPRETATION\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S01\"\n  },\n  {\n    \"id\": \"4417517b-de9e-4cd5-8e7e-488c08ba9c92\",\n    \"order\": 16,\n    \"text\": \"In this Agreement the following definitions apply:\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"acdd9fa7-9c33-41ac-b2b9-c92b841340b5\",\n    \"order\": 17,\n    \"text\": \"\\\"Controller Personal Data\\\" means the personal data described in Annex 1 and any other personal data that the Processor processes on behalf of the Controller in connection with the Services.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7d5551d1-2ebb-4449-ab19-20d0871fab2b\",\n    \"order\": 18,\n    \"text\": \"\\\"Data Protection Laws\\\" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other law of the United Kingdom, or of a part of the United Kingdom, relating to the protection of personal data that applies to the processing under this Agreement, each as amended or replaced from time to time.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"28a04f75-ff0a-4b24-bed8-46d0821e73f7\",\n    \"order\": 19,\n    \"text\": \"\\\"Domestic Law\\\" means the law of the United Kingdom or of a part of the United Kingdom.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"416ddac7-907e-4a66-b3b1-e8f043f4f70f\",\n    \"order\": 20,\n    \"text\": \"\\\"Personal Data Breach\\\" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Controller Personal Data transmitted, stored or otherwise processed.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7908021a-fbbb-4e89-b2b4-61c4664430ea\",\n    \"order\": 21,\n    \"text\": \"\\\"Regulator\\\" means the Information Commission, the data protection regulator of the United Kingdom, or any body that succeeds to its functions.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"9fc2b5e0-7acc-4261-9d6a-bdb92cb02a04\",\n    \"order\": 22,\n    \"text\": \"\\\"Restricted Transfer\\\" means a transfer of Controller Personal Data to a third country or an international organisation within the meaning of Chapter V of the UK GDPR, including any onward transfer and any making available of Controller Personal Data, including by remote access, to a recipient located outside the United Kingdom that is a separate legal person from the Party or Sub-processor making the data available.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d0577772-e71a-44c6-8feb-dd4a36f4054e\",\n    \"order\": 23,\n    \"text\": \"\\\"Security Measures\\\" means the technical and organisational measures described in Annex 2.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"48536a7e-f296-4c66-9c47-c62bfb56a010\",\n    \"order\": 24,\n    \"text\": \"\\\"Sub-processor\\\" means any person, other than an employee of the Processor, engaged by the Processor to process Controller Personal Data on behalf of the Controller.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"055fe6fc-41a7-44a6-8b6a-13dec59a9507\",\n    \"order\": 25,\n    \"text\": \"\\\"UK GDPR\\\" has the meaning given in section 3(10) of the Data Protection Act 2018.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c69ed139-f495-4b8e-a8b8-7471b179f6ad\",\n    \"order\": 26,\n    \"text\": \"\\\"Working Day\\\" means a day other than a Saturday, a Sunday or a bank holiday in England and Wales.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d35765c6-e614-41c6-8bdf-b6a70c4a9941\",\n    \"order\": 27,\n    \"text\": \"The terms \\\"controller\\\", \\\"processor\\\", \\\"data subject\\\", \\\"personal data\\\", \\\"processing\\\", \\\"special categories of personal data\\\", \\\"third country\\\" and \\\"international organisation\\\" have the meanings given to them in the UK GDPR. A reference to a statute or statutory provision includes that statute or provision as amended, extended or re-enacted from time to time and any subordinate legislation made under it. Clause headings do not affect the interpretation of this Agreement, and words such as \\\"including\\\" and \\\"in particular\\\" are illustrative and do not limit the general words that precede them. The Annexes form part of this Agreement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"988827ca-e8a2-48e9-8c5c-bb4f16a015ad\",\n    \"order\": 28,\n    \"text\": \"If there is any conflict between this Agreement and the Principal Agreement concerning the processing of Controller Personal Data, this Agreement prevails. In all other respects the Principal Agreement continues in full force and effect.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d90acea9-91d1-4b51-85e3-999001ff4e9b\",\n    \"order\": 29,\n    \"text\": \"<span id='4f5ef0e2-6c03-46d3-8b2b-2c832bc26a23'>2</span>. SCOPE AND ROLES OF THE PARTIES\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S02\"\n  },\n  {\n    \"id\": \"f9b82f74-77f2-4b26-8ae9-52e480fcffb3\",\n    \"order\": 30,\n    \"text\": \"The Controller is the controller and the Processor is the processor of the Controller Personal Data. The subject matter and duration of the processing, the nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"5445615f-5f24-48c9-b2e1-a1baa6947e89\",\n    \"order\": 31,\n    \"text\": \"The Processor shall process the Controller Personal Data only to the extent, and in such a manner, as is necessary to provide the Services and to follow the Controller's documented instructions. If the Processor determines the purposes and means of any processing in breach of this Agreement, it is to be treated as a controller in respect of that processing under Article 28(10) of the UK GDPR, and it is responsible for that processing.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"832f6d8f-2ae0-4ac6-85af-fa509fd1a639\",\n    \"order\": 32,\n    \"text\": \"The Processor warrants that it provides sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the UK GDPR and ensures the protection of the rights of data subjects, and that it has no reason to believe that any law applicable to it or to its Sub-processors prevents it from complying with this Agreement. It shall promptly inform the Controller if that ceases to be the case.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"b7a76130-284e-46fb-aecb-65f8e4d3cad2\",\n    \"order\": 33,\n    \"text\": \"Each Party shall comply with the obligations that the Data Protection Laws impose on it. This Agreement does not relieve either Party of its own direct responsibilities and liabilities under the Data Protection Laws.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"0a7b8fba-7497-4aaa-aef2-887900a2d464\",\n    \"order\": 34,\n    \"text\": \"This Agreement is drafted for processing that is subject to the Data Protection Laws. If the processing is also subject to the data protection law of another country, including the EU General Data Protection Regulation where it applies, the Parties shall agree in writing any additional terms that such law requires.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"ae79f40d-b9c3-4cb4-a71d-fc8765c2cdb0\",\n    \"order\": 35,\n    \"text\": \"<span id='8441f0d5-2a82-4c67-a6d9-de7d0a1907eb'>3</span>. OBLIGATIONS OF THE CONTROLLER\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S03\"\n  },\n  {\n    \"id\": \"c6649328-5c70-4740-ad47-f17e1bb68471\",\n    \"order\": 36,\n    \"text\": \"The Controller warrants and undertakes that it has a lawful basis under the Data Protection Laws for the processing described in Annex 1 and, where that processing includes special categories of personal data or personal data relating to criminal convictions and offences, that it meets a condition for that processing under Article 9 or Article 10 of the UK GDPR and the Data Protection Act 2018; that it has provided, or will provide, data subjects with the information required by Articles 13 and 14 of the UK GDPR; and that its instructions to the Processor comply with the Data Protection Laws. The Controller is responsible for the accuracy and lawfulness of the Controller Personal Data and of the means by which it obtained them.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"a1f3c64d-356f-47dd-9264-e1ddf9442802\",\n    \"order\": 37,\n    \"text\": \"The Controller shall not provide to the Processor, or instruct it to process, any special categories of personal data or any personal data relating to criminal convictions and offences unless the Parties have first amended Annex 1 in writing and agreed any additional Security Measures that those data require.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"no\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"86a245c9-c528-43c2-b23b-2f09a62799e3\",\n    \"order\": 38,\n    \"text\": \"The Controller confirms that the special categories of personal data or criminal offence data described in Annex 1 are processed under a condition of Article 9 or Article 10 of the UK GDPR and, where applicable, Schedule 1 to the Data Protection Act 2018, and shall inform the Processor of any specific restriction that applies to those data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"d594eeb5-44c7-42e0-8440-dfb4b485448a\",\n    \"order\": 39,\n    \"text\": \"<span id='bacba635-b19e-4f71-9375-631bdd6cd9c4'>4</span>. INSTRUCTIONS\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S04\"\n  },\n  {\n    \"id\": \"a9960a0a-d8ce-4b3d-86a8-47202e05f9ca\",\n    \"order\": 40,\n    \"text\": \"The Processor shall process the Controller Personal Data only on documented instructions from the Controller, including with regard to Restricted Transfers, unless it is required to do so by Domestic Law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"1d9eca50-bd7d-4ec3-adc9-721f41403fa3\",\n    \"order\": 41,\n    \"text\": \"At the date of this Agreement, the Controller's documented instructions consist of this Agreement, the Principal Agreement and the Controller's use of the functions of the Services. The Controller may give further reasonable instructions in writing, including by email, provided that they are consistent with the scope of the Services. Instructions that go beyond that scope are subject to agreement between the Parties, including as to any charges.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"3fb5d6e9-8151-4531-9c2c-7714593fd931\",\n    \"order\": 42,\n    \"text\": \"The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the UK GDPR or other Data Protection Laws. The Processor may suspend the execution of that instruction until the Controller confirms or modifies it in writing, and it is not obliged to carry out an instruction that it reasonably considers to be unlawful.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"5472151c-8d11-48c2-bb3f-413bd64aa969\",\n    \"order\": 43,\n    \"text\": \"The Processor shall ensure that any person acting under its authority who has access to Controller Personal Data, including any Sub-processor, does not process those data except on instructions from the Controller, unless that person is required to do so by Domestic Law.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"4af13d38-07bb-410d-991d-131c789ff8ad\",\n    \"order\": 44,\n    \"text\": \"If the Processor receives a request or order from a public authority, a court or any other third party to disclose Controller Personal Data, it shall, unless legally prohibited from doing so, promptly notify the Controller and give it a reasonable opportunity to respond. The Processor shall not disclose Controller Personal Data except as required by law, and shall then disclose only the data that it is legally required to disclose.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"677c244d-b119-4aec-a724-b6831f645359\",\n    \"order\": 45,\n    \"text\": \"<span id='bb22c8d9-6816-400f-9a71-c1df1ea39910'>5</span>. CONFIDENTIALITY\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S05\"\n  },\n  {\n    \"id\": \"e1fe5bf0-a35d-4979-b28f-ac002330a778\",\n    \"order\": 46,\n    \"text\": \"The Processor shall treat the Controller Personal Data as confidential and shall ensure that every person it authorises to process them, including its employees, agents and contractors and the personnel of its Sub-processors, has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, has received appropriate training in data protection and has access only to the Controller Personal Data that are necessary for that person's role. These confidentiality obligations continue after the end of this Agreement and after the end of that person's engagement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"868b5ddb-9b8c-48a9-b995-3c1297965201\",\n    \"order\": 47,\n    \"text\": \"<span id='38c8087b-94d4-497c-8cb9-0fd7a35c6f01'>6</span>. SECURITY OF PROCESSING\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S06\"\n  },\n  {\n    \"id\": \"77450f09-be57-4ed8-974a-ebc35fa0c489\",\n    \"order\": 48,\n    \"text\": \"Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, the Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. Those measures include at least the Security Measures.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"230abcae-a907-4ace-8a9a-0def5cdf440b\",\n    \"order\": 49,\n    \"text\": \"In assessing the appropriate level of security, the Processor shall take account in particular of the risks presented by the processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"873a8f49-365c-4492-9c05-e4c9f94fd5b1\",\n    \"order\": 50,\n    \"text\": \"The Processor shall regularly test, assess and evaluate the effectiveness of the Security Measures. It may update them as technology develops, provided that no update reduces the overall level of protection of the Controller Personal Data, and it shall inform the Controller in writing of any significant change.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"0589954d-5857-44a4-8365-09017f614e18\",\n    \"order\": 51,\n    \"text\": \"As the Controller Personal Data include special categories of personal data or criminal offence data, the Processor shall also apply to those data the enhanced measures set out in Annex 2 for such data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"8a9df4be-5c86-4bbf-a9b7-d52220952b78\",\n    \"order\": 52,\n    \"text\": \"<span id='d1701cdd-acab-4ea2-9f12-f206278e08cc'>7</span>. SUB-PROCESSORS\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S07\"\n  },\n  {\n    \"id\": \"418e3797-5aa2-4f71-a730-efffeeb9cb97\",\n    \"order\": 53,\n    \"text\": \"The Processor shall not engage any Sub-processor without the prior specific written authorisation of the Controller. No Sub-processor is authorised at the date of this Agreement. Each request for authorisation shall identify the proposed Sub-processor, its location, the processing that it will carry out and any Restricted Transfer involved.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"none\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"9ba59c09-176d-4b12-b2ad-6b9c8231994e\",\n    \"order\": 54,\n    \"text\": \"The Controller gives its specific written authorisation to the engagement of the Sub-processors listed in Annex 1 for the processing described there. The Processor shall not engage any other Sub-processor, or replace a listed Sub-processor, without the prior specific written authorisation of the Controller. Each request for authorisation shall identify the proposed Sub-processor, its location, the processing that it will carry out and any Restricted Transfer involved.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"specific\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"3dabf4d8-3f8b-4b0f-918a-44ae7925541f\",\n    \"order\": 55,\n    \"text\": \"The Controller gives its general written authorisation to the Processor to engage Sub-processors, and approves the Sub-processors listed in Annex 1. The Processor shall inform the Controller in writing at least 30 days in advance of any intended addition or replacement of a Sub-processor, identifying the Sub-processor, its location, the processing that it will carry out and any Restricted Transfer involved, thereby giving the Controller the opportunity to object to the change.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"general\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"15bb9362-851c-4d09-8892-a4937377c319\",\n    \"order\": 56,\n    \"text\": \"The Controller may object to the change on reasonable grounds relating to data protection by written notice given within 14 days after receiving that information. The Parties shall then discuss the objection in good faith. If they cannot resolve it within 30 days after the objection, the Processor shall not use that Sub-processor for the Controller Personal Data or, if it cannot provide the Services without it, either Party may terminate the affected Services by written notice, without liability for that termination, and the Processor shall refund any charges paid in advance for Services not provided after the termination. Until the objection has been resolved, the Processor shall not allow the new Sub-processor to process Controller Personal Data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"general\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"dc07f2eb-cfc7-4a21-ac89-61435415142f\",\n    \"order\": 57,\n    \"text\": \"Where a Sub-processor listed in Annex 1 is located outside the United Kingdom, or will access Controller Personal Data from outside the United Kingdom, the Controller's approval of that Sub-processor also authorises the Restricted Transfer necessary for the processing described there, which remains subject to the rest of clause 8.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"specific\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      },\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"general\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"9e111c96-1aad-43c8-bf84-be5ff5564605\",\n    \"order\": 58,\n    \"text\": \"Where the Processor engages a Sub-processor, it shall carry out appropriate due diligence beforehand and shall impose on the Sub-processor, by a written contract (which may be in electronic form), the same data protection obligations as those set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the UK GDPR. On request, the Processor shall provide the Controller with a copy of the data protection terms of that contract, from which commercial information may be removed.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"b24407d5-5d64-4a76-bd6d-2dee8939cded\",\n    \"order\": 59,\n    \"text\": \"The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations. If a Sub-processor fails to fulfil its data protection obligations, the Processor is liable to the Controller as if it had failed to fulfil them itself.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"e7dd2ce9-3457-4dc4-9994-dabbedf9ce1c\",\n    \"order\": 60,\n    \"text\": \"<span id='d689e849-ed00-48a4-aebd-c835d8eafa7c'>8</span>. TRANSFERS OUTSIDE THE UNITED KINGDOM\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S08\"\n  },\n  {\n    \"id\": \"48db1301-ccb6-41d2-9335-f5544da97bbe\",\n    \"order\": 61,\n    \"text\": \"The Processor shall not make any Restricted Transfer, and shall not allow any Sub-processor to make any Restricted Transfer, without the prior written authorisation of the Controller.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"value\": \"no\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"59efa2e7-32c7-41f5-9904-ed4d0e1d3d52\",\n    \"order\": 62,\n    \"text\": \"The Controller authorises the Restricted Transfers described in Annex 1. The Processor shall not make any other Restricted Transfer, and shall not allow any Sub-processor to make any other Restricted Transfer, without the prior written authorisation of the Controller.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"b6257c0a-2498-40d3-863c-54e51ef346c9\",\n    \"order\": 63,\n    \"text\": \"Access to Controller Personal Data from outside the United Kingdom by an employee of the Processor or of a Sub-processor, for example while travelling, is not in itself a Restricted Transfer, but the Processor shall ensure that the Security Measures apply to that access.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7dfdb291-cadf-4d48-b9f5-a6696a541b01\",\n    \"order\": 64,\n    \"text\": \"Any Restricted Transfer, whether authorised at the date of this Agreement or later, may take place only if the condition in Article 44A of the UK GDPR is met and the transfer otherwise complies with the Data Protection Laws: the transfer must be approved by regulations made under Article 45A of the UK GDPR that are in force at the time of the transfer, or be made subject to appropriate safeguards under Article 46 of the UK GDPR, such as binding corporate rules or standard data protection clauses issued under section 119A of the Data Protection Act 2018 (including the International Data Transfer Agreement and the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses), in the version for the time being in force, or, exceptionally and only where the Controller has agreed in writing, be made in reliance on a derogation in Article 49 of the UK GDPR; and in each case only to the extent that the transfer is not restricted by regulations made under Article 49A of the UK GDPR.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"e08bf2c9-922e-4a13-9178-7de41fb6cad6\",\n    \"order\": 65,\n    \"text\": \"Where the Parties have entered into the International Data Transfer Agreement or the International Data Transfer Addendum, that document prevails over this Agreement and the Principal Agreement in the event of any inconsistency or conflict in respect of the Restricted Transfers that it covers, except where, and in so far as, the conflicting provision of this Agreement provides greater protection for data subjects or is an obligation of the Processor required by Article 28 of the UK GDPR, in which case that provision applies.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c4cde136-6388-4239-92e5-6e950e056488\",\n    \"order\": 66,\n    \"text\": \"Where a Restricted Transfer relies on appropriate safeguards, the Party making the transfer shall, before the transfer and acting reasonably and proportionately, assess whether the data protection test in Article 46(6) of the UK GDPR is met, namely whether, after the transfer, the standard of protection provided for data subjects by the safeguards and, where relevant, by other means would not be materially lower, taken as a whole, than the standard of protection provided by the UK GDPR, Part 2 of the Data Protection Act 2018 and, so far as relevant, Parts 5 to 7 of that Act, and shall keep a written record of that assessment. The Processor shall procure that any Sub-processor making a Restricted Transfer does the same, shall provide the Controller on request with a copy of the assessments made by it or its Sub-processors, and shall give the Controller the information it reasonably needs to assess any Restricted Transfer that the Controller makes to the Processor.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"82ca44aa-bd93-4d33-9caa-d2b5a3540512\",\n    \"order\": 67,\n    \"text\": \"The Parties shall put in place the safeguards required for each Restricted Transfer between them, for example by signing the International Data Transfer Agreement, and the Processor shall procure that the required safeguards are in place for each Restricted Transfer made by it or by a Sub-processor. If the basis relied on for a Restricted Transfer ceases to be available, the Processor shall promptly inform the Controller and suspend the transfer until a lawful basis is in place.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"599d600c-bea4-4d0b-8cbf-b7df21231bc5\",\n    \"order\": 68,\n    \"text\": \"<span id='18cf10ea-61bf-4d0f-8221-b1b786d552d2'>9</span>. DATA SUBJECT RIGHTS AND COMPLAINTS\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S09\"\n  },\n  {\n    \"id\": \"b42802db-395c-43e3-a48c-502a3e8569b8\",\n    \"order\": 69,\n    \"text\": \"Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from data subjects exercising their rights under Chapter III of the UK GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability and objection.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"2e64ac32-9f4d-4a01-86b3-71399262b402\",\n    \"order\": 70,\n    \"text\": \"If the Processor receives a request from a data subject relating to Controller Personal Data, or a complaint about the processing of Controller Personal Data that the Controller must handle under section 164A of the Data Protection Act 2018, it shall forward it to the Controller promptly and in any event within 3 Working Days after receiving it. The Processor shall not respond to the request or complaint itself, except to acknowledge receipt and to tell the data subject that it has been passed to the Controller, unless the Controller authorises it to do so. It shall give the Controller the information and assistance that the Controller reasonably needs to respond within the time limits set by the Data Protection Laws.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"12e90761-552a-4368-b150-7213d1190043\",\n    \"order\": 71,\n    \"text\": \"<span id='46b37062-b336-4034-a3fb-0c85c72aa549'>10</span>. PERSONAL DATA BREACHES\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S10\"\n  },\n  {\n    \"id\": \"42e28c69-8ba7-4fdb-9b87-d3e6cabc3c74\",\n    \"order\": 72,\n    \"text\": \"The Processor shall notify the Controller of any Personal Data Breach without undue delay after becoming aware of it, and in any event within <span id='c6b7b012-980d-4b12-80ec-608bd7c11bc5'>48 hours</span>, by email to the Controller's data protection contact named in Annex 1, followed by a telephone call where possible.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"0036f392-dc93-40f0-9fae-f532987b3a07\",\n    \"order\": 73,\n    \"text\": \"The notification shall, as far as the information is then available to the Processor, describe the nature of the Personal Data Breach, including where possible the categories and approximate number of data subjects and of personal data records concerned; give the name and contact details of the Processor's contact point; describe the likely consequences of the breach; and describe the measures taken or proposed to address the breach and to mitigate its possible adverse effects. Where it is not possible to provide all of that information at the same time, the Processor shall provide it in phases without undue further delay.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"dc623535-e118-46ea-942d-12432985becf\",\n    \"order\": 74,\n    \"text\": \"The Processor shall take all reasonable steps to contain, investigate and remedy the Personal Data Breach and to mitigate its effects, shall cooperate with the Controller and follow its reasonable instructions, and shall keep a record of the facts relating to the breach, its effects and the remedial action taken. This assistance is intended to enable the Controller to meet its own obligations to notify the Regulator, where required, without undue delay and, where feasible, within 72 hours after becoming aware of the breach, and to communicate the breach to data subjects where required, under Articles 33 and 34 of the UK GDPR.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c973a9d6-6a26-4936-a251-8c9c6539917c\",\n    \"order\": 75,\n    \"text\": \"The Processor shall not notify the Regulator, data subjects or any other third party of a Personal Data Breach affecting Controller Personal Data without the prior written consent of the Controller, unless the law requires it to do so, in which case it shall, where legally permitted, inform the Controller beforehand. A notification by the Processor under this clause is not in itself an acknowledgement of fault or liability.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"fd944112-ff1d-41e3-ab94-6f0eac1601cf\",\n    \"order\": 76,\n    \"text\": \"<span id='5e0b325d-98e5-41ae-8055-faf2418b12c6'>11</span>. IMPACT ASSESSMENTS, RECORDS AND THE REGULATOR\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S11\"\n  },\n  {\n    \"id\": \"c8ae90f0-e569-4c8f-abc5-e04f5e592f2f\",\n    \"order\": 77,\n    \"text\": \"Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 of the UK GDPR, including by providing the information and assistance reasonably required for any data protection impact assessment relating to the processing under this Agreement and for any prior consultation of the Regulator.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d2bac8f1-17a9-4c4e-a613-3f302e46637c\",\n    \"order\": 78,\n    \"text\": \"Where Article 30(2) of the UK GDPR applies to it, the Processor shall maintain a written record, which may be in electronic form, of all categories of processing activities carried out on behalf of the Controller, containing the information required by that provision, and shall make it available to the Controller and to the Regulator on request. Where Article 37 of the UK GDPR requires the Processor to designate a data protection officer, it shall do so and shall give the Controller that officer's contact details.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"963ef4de-f59c-4cf8-bc3a-02885a08b429\",\n    \"order\": 79,\n    \"text\": \"The Processor shall cooperate, on request, with the Regulator in the performance of its tasks and shall, unless prohibited by law, promptly inform the Controller of any enquiry, investigation, notice or other communication from the Regulator concerning the Controller Personal Data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"f5edc134-092b-498e-b9ea-08d27a1fcca1\",\n    \"order\": 80,\n    \"text\": \"<span id='42d5946c-3807-4550-8c03-ee69f19a9819'>12</span>. INFORMATION AND AUDITS\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S12\"\n  },\n  {\n    \"id\": \"42ed46b8-6b6b-475d-a292-b56d83d501d8\",\n    \"order\": 81,\n    \"text\": \"The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and in this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"383b040c-2076-46eb-826f-0ae292724fe8\",\n    \"order\": 82,\n    \"text\": \"To avoid unnecessary disruption, the Controller shall first consider the information that the Processor can provide, such as current certifications (for example ISO/IEC 27001), independent audit reports and written answers to reasonable security questionnaires. An inspection of premises or systems shall take place on at least 30 days' written notice, during normal business hours and no more than once in any period of 12 months, unless the Controller reasonably suspects a breach of this Agreement, a Personal Data Breach has occurred or the Regulator requires the inspection, in which case reasonable shorter notice applies. Any auditor shall be bound by a duty of confidentiality and shall comply with the Processor's reasonable security and health and safety rules, and no inspection shall give access to the data of the Processor's other customers.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"35edc332-d48a-4ff9-afa8-a1b6880780ae\",\n    \"order\": 83,\n    \"text\": \"Subject to clause 13, each Party bears its own costs of an audit, unless the audit reveals a material breach of this Agreement by the Processor, in which case the Processor shall reimburse the Controller's reasonable costs of the audit and shall promptly remedy the breach.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"316e6ca9-e1a4-4efd-b583-acc87801ad87\",\n    \"order\": 84,\n    \"text\": \"<span id='ec9b2e80-be71-49aa-8bf6-9ef207ca448d'>13</span>. CHARGES FOR ASSISTANCE\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S13\"\n  },\n  {\n    \"id\": \"019b69ef-bd96-4046-92fe-e5a0230f65d5\",\n    \"order\": 85,\n    \"text\": \"The assistance that the Processor provides under clauses 9 to 12 is included in the charges payable under the Principal Agreement, and the Processor is not entitled to any additional payment for it.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b01c7a2c-6a35-426d-b37e-88638967e1b0\",\n        \"value\": \"included\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"c582f316-7bae-46f9-80f4-bcd94fbb3909\",\n    \"order\": 86,\n    \"text\": \"The Processor may charge the Controller for the assistance that it provides under clauses 9, 11 and 12 (other than for an audit or inspection that reveals a material breach of this Agreement by the Processor) at its standard rates or at rates agreed in advance, provided that the charges are reasonable and that the Processor gives the Controller an estimate before incurring significant costs. No charge is payable for the Processor's obligations under clause 10, or for any assistance made necessary by a breach of this Agreement or of the Data Protection Laws by the Processor or a Sub-processor.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b01c7a2c-6a35-426d-b37e-88638967e1b0\",\n        \"value\": \"chargeable\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"39cd3b9c-cf31-4946-b6f6-dbeb59e7ede5\",\n    \"order\": 87,\n    \"text\": \"<span id='36c18466-f466-4093-a767-4cd6ab31e5bf'>14</span>. LIABILITY\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S14\"\n  },\n  {\n    \"id\": \"76ae2227-95f1-4f7a-b2ef-947c3ee5228c\",\n    \"order\": 88,\n    \"text\": \"Each Party is liable to data subjects as provided in Article 82 of the UK GDPR. Under Article 82(2), the Processor is liable for the damage caused by processing only where it has not complied with obligations of the UK GDPR specifically directed to processors or where it has acted outside or contrary to the lawful instructions of the Controller. Where one Party has paid full compensation to a data subject for damage for which both Parties are responsible, it may claim back from the other Party that part of the compensation corresponding to the other Party's part of responsibility for the damage, in accordance with Article 82(5) of the UK GDPR.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"ecb54459-66a4-4057-be1f-977f7f2efc61\",\n    \"order\": 89,\n    \"text\": \"Subject to the last paragraph of this clause, each Party's liability to the other under or in connection with this Agreement is subject to the limitations and exclusions of liability set out in the Principal Agreement, if any. Any amount paid under this Agreement counts towards any aggregate limit in the Principal Agreement. Where the Principal Agreement contains no such limitation, that liability is determined by the general law.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b416da09-59d5-4293-a508-e82f196f5d63\",\n        \"value\": \"no\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"b433ec5a-3f24-4895-a9f2-8e490dd52de6\",\n    \"order\": 90,\n    \"text\": \"Subject to the last paragraph of this clause, the total aggregate liability of each Party to the other under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed <span id='7ed3d201-1b80-433f-9537-843889985289'>[amount of the liability cap]</span>. This limit applies to any claim between the Parties under Article 82(5) of the UK GDPR, but does not apply to charges payable under this Agreement or the Principal Agreement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b416da09-59d5-4293-a508-e82f196f5d63\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"e8817dc1-4ba4-4a54-9065-cd470448597c\",\n    \"order\": 91,\n    \"text\": \"Nothing in this Agreement or in the Principal Agreement limits or excludes either Party's liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded by law, and no limitation of liability between the Parties affects the rights of data subjects against either of them.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"9df5009c-e12f-4e95-8fd1-35e9fbc61b0b\",\n    \"order\": 92,\n    \"text\": \"<span id='484bd2ec-a9fc-4c5e-a9cc-64f74fceaed9'>15</span>. DURATION AND TERMINATION\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S15\"\n  },\n  {\n    \"id\": \"145ef0d1-a056-4d74-8ce2-faa69f15da84\",\n    \"order\": 93,\n    \"text\": \"This Agreement takes effect on the date stated at its beginning and continues for as long as the Processor or any Sub-processor processes Controller Personal Data. It ends automatically when the Processor has completed the return or deletion of the Controller Personal Data under clause 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n        \"value\": \"services\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"7fc0cad0-7dc5-4da6-abcf-b20beb6b6bed\",\n    \"order\": 94,\n    \"text\": \"This Agreement takes effect on the date stated at its beginning. The Processor may process Controller Personal Data until <span id='00915b70-fd16-4b84-9dde-38f9414a62db'>[end date of the processing]</span>, unless the Services end earlier or the Parties extend that date by a variation made in accordance with clause 17. This Agreement continues for as long as the Processor or any Sub-processor processes Controller Personal Data, and ends automatically when the Processor has completed the return or deletion of the Controller Personal Data under clause 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n        \"value\": \"date\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"fe581acd-8191-40c2-92ae-583cd822cf60\",\n    \"order\": 95,\n    \"text\": \"The end of the Principal Agreement or of the Services ends the Processor's authority to process Controller Personal Data, except to the extent necessary to comply with clause 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"891008d9-1bce-4a97-8a54-7965688c5911\",\n    \"order\": 96,\n    \"text\": \"If the Processor commits a material breach of this Agreement or of the Data Protection Laws that is not capable of remedy or, if capable of remedy, is not remedied within 30 days after written notice requiring it to be remedied, the Controller may, by written notice and without prejudice to its other rights and remedies, suspend the transfer of Controller Personal Data to the Processor and terminate with immediate effect this Agreement and the Principal Agreement insofar as it relates to the processing of Controller Personal Data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"10bb5013-53d2-4c4c-9c86-2bb49d537edb\",\n    \"order\": 97,\n    \"text\": \"Clauses 5, 13, 14, 17 and 18, and any other provision that is expressly or by implication intended to continue, survive the end of this Agreement without limit of time. In addition, for as long as the Processor or any Sub-processor holds any Controller Personal Data after the end of this Agreement, including in back-up systems or under clause 16, all the obligations of the Processor under this Agreement continue to apply to those data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d1a7a412-7a72-424d-bde6-01634efe6b1a\",\n    \"order\": 98,\n    \"text\": \"<span id='a443e787-cfaa-4bf8-960b-2e3f555b3628'>16</span>. RETURN AND DELETION OF PERSONAL DATA\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S16\"\n  },\n  {\n    \"id\": \"1c019d7f-63e7-4e52-87db-dc784bbcca35\",\n    \"order\": 99,\n    \"text\": \"When the provision of the Services relating to the processing ends, or the Processor's authority to process Controller Personal Data otherwise ends under clause 15 (the \\\"End of Processing\\\"), the Processor shall, at the choice of the Controller notified in writing, either delete all the Controller Personal Data or return them to the Controller in a commonly used, machine-readable format and then delete them, and shall delete existing copies, unless Domestic Law requires storage of the personal data.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c1f50f7f-720e-4e98-999c-02843ecfe26e\",\n    \"order\": 100,\n    \"text\": \"If the Controller has not notified its choice within 30 days after the End of Processing, the Processor shall ask it to do so in writing and, if no choice is notified within 14 days after that request, shall delete the Controller Personal Data. The Processor shall complete the return and deletion within 30 days after the Controller's choice, or after the end of that 14-day period. Copies held in back-up systems shall be kept secure, shall not be processed further and shall be deleted or overwritten in the normal back-up cycle, and in any event within 90 days after the End of Processing.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"94d63b4d-2ec8-4fc1-b9dc-58b452897cef\",\n    \"order\": 101,\n    \"text\": \"If Domestic Law requires the Processor to keep any Controller Personal Data, the Processor shall inform the Controller, keep those data confidential, process them only for the purpose required by that law and delete them when the legal obligation ends. On request, the Processor shall confirm in writing that it has complied with this clause and that each Sub-processor has done the same.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"74a03b96-019d-4264-bb45-310f59973ad5\",\n    \"order\": 102,\n    \"text\": \"<span id='c0d04489-71e3-4adf-b7c7-00fc8742f121'>17</span>. GENERAL\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S17\"\n  },\n  {\n    \"id\": \"d1c99ee0-9ce8-4a8f-bdd0-43ce1a1fac0f\",\n    \"order\": 103,\n    \"text\": \"Notices. Any notice under this Agreement must be in writing. It may be sent by email to the data protection contact of the other Party named in Annex 1, or delivered by hand or sent by pre-paid first-class post (or, if the address is outside the United Kingdom, by pre-paid international airmail or international courier) to the address of the other Party stated at the beginning of this Agreement. A notice is deemed received, if delivered by hand, on delivery; if posted in the United Kingdom, at 9.00 am on the second Working Day after posting; if sent by international airmail or courier, at 9.00 am on the fifth Working Day after posting or dispatch; and, if sent by email, at the time of transmission or, if that time falls outside 9.00 am to 5.00 pm on a Working Day, at 9.00 am on the next Working Day.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c22eee9d-cc7a-4d5b-b218-17b19cadd237\",\n    \"order\": 104,\n    \"text\": \"Contact details of the Parties. Each Party processes the business contact details of the other Party's representatives as a separate controller, only for the purpose of managing this Agreement and the Principal Agreement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"e2ccc8f3-1b9e-4ea5-b7cb-2e29de2090fc\",\n    \"order\": 105,\n    \"text\": \"Variation. No variation of this Agreement is effective unless it is in writing and signed by or on behalf of each Party. Each Party shall, on request, negotiate in good faith any amendment needed to reflect a change in the Data Protection Laws or any standard clauses or guidance issued by the Regulator or the Secretary of State.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"b924cb7a-748c-4f47-81e2-c5725360d111\",\n    \"order\": 106,\n    \"text\": \"Assignment. Neither Party may assign or transfer this Agreement without the prior written consent of the other Party, except together with an assignment or transfer of the Principal Agreement permitted by its terms.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"61e9b43c-ba12-45f1-85b9-9e3b1c82f543\",\n    \"order\": 107,\n    \"text\": \"Severance. If any provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable or, if that is not possible, deleted, and the remaining provisions continue in force.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"39621633-2d58-4729-8066-75d81ecaa0bd\",\n    \"order\": 108,\n    \"text\": \"Waiver. No failure or delay by a Party in exercising any right or remedy under this Agreement constitutes a waiver of that or any other right or remedy.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"df840532-af0b-413e-9c9c-ccfd411b9c00\",\n    \"order\": 109,\n    \"text\": \"Third party rights. A person who is not a Party has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement. This does not affect any right or remedy that a data subject has under the Data Protection Laws.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"530aeaa3-6654-423c-b7ae-9a7f10634bf8\",\n    \"order\": 110,\n    \"text\": \"Entire agreement. This Agreement, together with the Principal Agreement, constitutes the entire agreement between the Parties relating to the processing of Controller Personal Data and supersedes any previous data processing terms between them on that subject. Nothing in this clause limits liability for fraud.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"e16da157-6631-49e4-b4e7-ad33d9994964\",\n    \"order\": 111,\n    \"text\": \"Counterparts and electronic signature. This Agreement may be signed in any number of counterparts and by electronic signature, each of which is an original and which together constitute one agreement. It is in writing within the meaning of Article 28(9) of the UK GDPR.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"9f3bb3dd-c752-4a12-8dad-fa1bf4e5c8f9\",\n    \"order\": 112,\n    \"text\": \"<span id='97be0412-d87d-44a4-abab-e059e537e617'>18</span>. GOVERNING LAW AND JURISDICTION\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"12\",\n    \"sectionNum\": \"S18\"\n  },\n  {\n    \"id\": \"5b187c74-235a-414e-9ac0-e371ea495021\",\n    \"order\": 113,\n    \"text\": \"This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation are governed by the law of England and Wales. The law of Scotland and the law of Northern Ireland do not apply to it.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"952a36cd-f043-40f9-b7c3-139a76d6e281\",\n    \"order\": 114,\n    \"text\": \"Each Party irrevocably agrees that the courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim. Before starting court proceedings, except to seek urgent interim relief or to protect a claim from becoming time-barred, the Parties shall try in good faith to resolve the dispute through discussion between senior representatives within 30 days after either Party gives written notice of the dispute.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7b1790b3-c289-4c31-ab77-e90d56cc6575\",\n    \"order\": 115,\n    \"text\": \"This Agreement has been entered into on the date stated at its beginning.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"15\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"15\"\n  },\n  {\n    \"id\": \"4628a527-343d-4fd7-836a-97d7c14b488a\",\n    \"order\": 116,\n    \"text\": \"Signed for and on behalf of <span id='c9781c2d-0c4f-46a0-b390-6a8afa21b833'>[registered name of the Controller]</span> (the Controller)\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"93515fa3-7eaa-4808-9eca-15f8391486a5\",\n    \"order\": 117,\n    \"text\": \"Signed by <span id='056c7707-f262-47bf-b66e-f887e5a73359'>[full name of the Controller]</span> (the Controller)\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"individual\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"c75601ad-c949-4ea4-b8ed-645c0b1c2a51\",\n    \"order\": 118,\n    \"text\": \"Signature: ____________________________________\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"8b07075b-9b99-480b-9763-40dcf95886c0\",\n    \"order\": 119,\n    \"text\": \"Name: <span id='78e41aa3-0d34-4b32-8d08-524e6012e9f7'>[name of the person signing for the Controller]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"1c9970a6-f658-4e9d-a66b-3feb76247ff5\",\n    \"order\": 120,\n    \"text\": \"Position: <span id='d8b62dae-61ca-44a0-93a1-1e090a75d60e'>[position of the person signing for the Controller]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"c71342c9-b50c-4c72-8603-199904787818\",\n    \"order\": 121,\n    \"text\": \"Date: ____________________________________\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"20\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"214ce500-92d2-402b-bfb1-7448ac9f39de\",\n    \"order\": 122,\n    \"text\": \"Signed for and on behalf of <span id='7c30029e-906f-460a-9f8e-80433de65a08'>[registered name of the Processor]</span> (the Processor)\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"524b2903-23a5-4218-b11f-baa60913853b\",\n    \"order\": 123,\n    \"text\": \"Signed by <span id='8e066ff0-7b0c-4b2a-bc03-60b88760ffc8'>[full name of the Processor]</span> (the Processor)\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"individual\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"59275de7-e315-4e6f-8364-81127d521530\",\n    \"order\": 124,\n    \"text\": \"Signature: ____________________________________\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"7f2cc06b-0381-4b7a-b2d7-b2e35ed31c6a\",\n    \"order\": 125,\n    \"text\": \"Name: <span id='fe7b57cb-73ca-4f5e-b12c-17c15cdabfa6'>[name of the person signing for the Processor]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"9d0fd2ea-b9fa-4f38-96c8-09ff0e1e618c\",\n    \"order\": 126,\n    \"text\": \"Position: <span id='9e82bfbe-7601-4bff-9b06-355c8b9c5270'>[position of the person signing for the Processor]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"5\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"company\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"10c91431-bf0b-40b2-86af-cfc7c4d3ea24\",\n    \"order\": 127,\n    \"text\": \"Date: ____________________________________\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"20\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"3827db6a-971f-4ca7-aece-61b170e0c5e3\",\n    \"order\": 128,\n    \"text\": \"ANNEX 1: DETAILS OF THE PROCESSING\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"pageBreakBefore\": true\n  },\n  {\n    \"id\": \"2e0238d6-1e1d-46f5-9a60-688dadaa7c39\",\n    \"order\": 129,\n    \"text\": \"Subject matter of the processing (the Services): <span id='e98853be-1698-4304-86cd-d2c66f2818b0'>[description of the services]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"43451280-5272-4b16-aea0-f5a5d18015fb\",\n    \"order\": 130,\n    \"text\": \"Duration of the processing: for as long as the Processor provides the Services, and then until the Controller Personal Data have been returned or deleted under clause 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n        \"value\": \"services\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"069adb00-7312-4927-baae-070225ca16d0\",\n    \"order\": 131,\n    \"text\": \"Duration of the processing: until <span id='0275c034-0bbb-4a37-a31a-8aa2e70668b2'>[end date of the processing]</span>, unless the Services end earlier, and then until the Controller Personal Data have been returned or deleted under clause 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n        \"value\": \"date\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"96aea3d4-525a-4099-a62b-9c9ae8397a6b\",\n    \"order\": 132,\n    \"text\": \"Nature of the processing: <span id='abe3638d-f758-4796-be0f-ae45c4354845'>[nature of the processing]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"703e6148-c9cd-4e6b-9c95-5645d99cb5f6\",\n    \"order\": 133,\n    \"text\": \"Purpose of the processing: <span id='9a383304-c54f-4e4b-b565-6c5c5b7f0e38'>[purpose of the processing]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"5c218c82-f151-49c0-837c-29543d585ea0\",\n    \"order\": 134,\n    \"text\": \"Types of personal data: <span id='1f4c842f-32bb-4b6e-9f14-6d5895a6c09c'>[types of personal data]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"110719a2-aef9-4a9d-990b-aa81d2858e23\",\n    \"order\": 135,\n    \"text\": \"Special categories of personal data and criminal offence data: none. Such data may be provided only after this Annex has been amended in writing under clause 3.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"no\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"4b9a8140-5423-439a-bb53-9cf99858ac89\",\n    \"order\": 136,\n    \"text\": \"Special categories of personal data and criminal offence data, to which the enhanced measures in Annex 2 apply: <span id='2e4e34a0-4ed6-4021-aa3c-b743632b389a'>[special category or criminal offence data]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"a5efa2fa-b84b-493e-801f-eb5d7fb63f24\",\n    \"order\": 137,\n    \"text\": \"Categories of data subjects: <span id='8056a543-47bb-40b5-a774-0a6d9e9de26b'>[categories of data subjects]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"af002291-c046-4cf9-9f02-61424485c459\",\n    \"order\": 138,\n    \"text\": \"Authorised Sub-processors: none at the date of this Agreement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"none\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"efa08edf-0a4e-4e7a-9ade-6d7fa29888f5\",\n    \"order\": 139,\n    \"text\": \"Authorised Sub-processors (specific authorisation under clause 7): <span id='a5dc8207-fe45-48f2-85b7-8ee486bdf9c0'>[authorised sub-processors]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"specific\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"964ba623-c702-48be-91b4-70a36a81cc6d\",\n    \"order\": 140,\n    \"text\": \"Authorised Sub-processors (approved under the general authorisation in clause 7): <span id='13d3e679-acc8-4a07-8b77-a2251cf6dc1c'>[authorised sub-processors]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"general\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"ac044a2f-a064-40da-9827-79e79dc3212e\",\n    \"order\": 141,\n    \"text\": \"Restricted Transfers: none authorised at the date of this Agreement.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"value\": \"yes\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      },\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"specific\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      },\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"general\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"cc2f8357-c133-40f3-ad3f-abc5a5eafd6c\",\n    \"order\": 142,\n    \"text\": \"Restricted Transfers: none authorised at the date of this Agreement, other than any transfer to a Sub-processor listed above that clause 7 authorises.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"value\": \"yes\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      },\n      {\n        \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"value\": \"none\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"1873b68a-3de9-4e44-ba66-c4d094dd2909\",\n    \"order\": 143,\n    \"text\": \"Restricted Transfers authorised under clause 8: <span id='7ae41a0b-6ac6-4ab2-91cd-01065cb95f6e'>[authorised transfers outside the United Kingdom]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"32b41890-8f78-4c99-861d-70b7486bd64a\",\n    \"order\": 144,\n    \"text\": \"Data protection contact of the Controller: <span id='d5c2db5f-57b4-42cc-99a3-0e87b0126506'>[data protection contact of the Controller]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"bfdecd8b-6580-4675-9145-2730f1115a97\",\n    \"order\": 145,\n    \"text\": \"Data protection contact of the Processor: <span id='89fe74af-f717-4a66-a0a2-7a8d854e4aa0'>[data protection contact of the Processor]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"d5fa99a3-98e7-42cb-bf53-d19c7b8636df\",\n    \"order\": 146,\n    \"text\": \"Obligations and rights of the Controller: as set out in this Agreement, in particular in clauses 3, 4, 7, 12 and 16.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"76023b70-bf1e-4ee9-b46b-4f3bd12f7f01\",\n    \"order\": 147,\n    \"text\": \"ANNEX 2: SECURITY MEASURES\",\n    \"fontSize\": \"16\",\n    \"textAlign\": \"left\",\n    \"bold\": true,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"marginTop\": \"20\"\n  },\n  {\n    \"id\": \"e6d450a1-469d-4da9-9091-f3467eb08890\",\n    \"order\": 148,\n    \"text\": \"The Processor shall implement and maintain at least the following technical and organisational measures, in a manner appropriate to the nature of the Services and to the risk for data subjects.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"5ae2bc0a-8a12-47ff-a033-0b3480837140\",\n    \"order\": 149,\n    \"text\": \"Governance: a written information security policy approved by management and reviewed at least once a year, and a named person responsible for information security and data protection.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"25a86191-c9e4-43dd-bf84-8aab5e8c1d45\",\n    \"order\": 150,\n    \"text\": \"Access control: access to Controller Personal Data on a need-to-know and least-privilege basis, individual user accounts, strong passwords, multi-factor authentication for remote and administrative access, regular review of access rights and prompt removal of access that is no longer needed.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"18cdc3e7-ffc9-4e7b-bf2f-429dc70e3e40\",\n    \"order\": 151,\n    \"text\": \"Encryption and pseudonymisation: encryption of Controller Personal Data in transit over public networks using current industry standards, encryption of laptops, mobile devices and removable media, and pseudonymisation where it is appropriate to the Services.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"c8d1ef3e-aaa3-4360-8847-a6316a905cc8\",\n    \"order\": 152,\n    \"text\": \"Confidentiality, integrity, availability and resilience of systems: firewalls, up-to-date anti-malware software, timely application of security patches, secure configuration of systems and logical separation of the Controller Personal Data from the data of other customers.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"da1e41f0-34fe-40c2-a4be-a339d7d59ee5\",\n    \"order\": 153,\n    \"text\": \"Back-up and restoration: regular back-ups stored securely, and tested procedures to restore the availability of and access to Controller Personal Data in a timely manner after a physical or technical incident.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"0b1cec31-8301-4b12-9913-21b7ca843750\",\n    \"order\": 154,\n    \"text\": \"Logging and monitoring: logging of access to systems holding Controller Personal Data, with logs protected against alteration and reviewed for suspicious activity.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"e89aa9d8-3434-4196-b3e9-c25d0807e7be\",\n    \"order\": 155,\n    \"text\": \"Physical security: protection of premises, equipment and paper records against unauthorised access, and secure disposal of paper records and storage media.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"8c201058-8e99-4bc3-85f6-aa204aa1828f\",\n    \"order\": 156,\n    \"text\": \"Personnel: confidentiality undertakings, data protection and security training on joining and at regular intervals, and disciplinary consequences for breaches.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"018c306b-feb5-43bc-b843-c001ae5a37ec\",\n    \"order\": 157,\n    \"text\": \"Incident management: a documented procedure to detect, report, contain and investigate Personal Data Breaches and to notify the Controller in accordance with clause 10.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"df563119-012f-4924-873a-050f6c8c2132\",\n    \"order\": 158,\n    \"text\": \"Testing: regular testing, assessment and evaluation of the effectiveness of these measures, including vulnerability scanning and, where appropriate to the risk, penetration testing.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"cdef7efc-818d-40f8-a78f-cde0d8d3fac8\",\n    \"order\": 159,\n    \"text\": \"Sub-processors: due diligence and contractual commitments ensuring that each Sub-processor applies measures at least equivalent to those in this Annex.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true\n  },\n  {\n    \"id\": \"fbb7d43c-70e0-4f7f-a46b-6bee708c1a85\",\n    \"order\": 160,\n    \"text\": \"Enhanced measures for special category and criminal offence data: encryption of those data at rest and in transit, access restricted to named personnel who need the data to perform the Services, regular review of the access logs, and no use of those data in testing or development environments.\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"value\": \"yes\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  },\n  {\n    \"id\": \"da0f8673-9046-4716-8558-ceee2924ea14\",\n    \"order\": 161,\n    \"text\": \"Additional measures agreed by the Parties: <span id='7691b849-cb2c-4187-9403-c08655b58270'>[additional security measures]</span>\",\n    \"fontSize\": \"14\",\n    \"textAlign\": \"left\",\n    \"bold\": false,\n    \"underline\": false,\n    \"marginBottom\": \"10\",\n    \"cflou\": false,\n    \"active\": true,\n    \"displayConditions\": [\n      {\n        \"field\": \"078a6515-6559-46be-9b6c-878f7f1f8a35\",\n        \"value\": \"additional\",\n        \"type\": \"add\",\n        \"operator\": \"=\"\n      }\n    ]\n  }\n]\n","form":"[\n  {\n    \"id\": \"07e3483b-51cf-4be3-97b7-092f25148d65\",\n    \"stepId\": \"07e3483b-51cf-4be3-97b7-092f25148d65\",\n    \"productId\": 2093,\n    \"name\": \"About this agreement\",\n    \"order\": 1,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"243592b9-85fb-42a5-8f9c-626bb0b044ef\",\n        \"stepId\": \"07e3483b-51cf-4be3-97b7-092f25148d65\",\n        \"type\": \"label\",\n        \"label\": \"This agreement sets the terms on which a supplier (the processor) handles personal data for your organisation (the controller), as Article 28 of the UK GDPR requires: IT support, cloud hosting, payroll, a mailing platform or a call centre, for example. Both parties sign it alongside the main services contract. It is governed by the law of England and Wales. It does not suit a supplier that decides for itself why and how the data is used.\",\n        \"placeholder\": \"\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"This agreement sets the terms on which a supplier (the processor) handles personal data for your organisation (the controller), as Article 28 of the UK GDPR requires: IT support, cloud hosting, payroll, a mailing platform or a call centre, for example. Both parties sign it alongside the main services contract. It is governed by the law of England and Wales. It does not suit a supplier that decides for itself why and how the data is used.\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"620584a2-56dd-43e1-8ab3-df7ecfd58990\",\n        \"stepId\": \"07e3483b-51cf-4be3-97b7-092f25148d65\",\n        \"type\": \"date\",\n        \"label\": \"Date of this agreement\",\n        \"placeholder\": \"e.g. 15/03/2027\",\n        \"helpText\": \"Usually the date on which the last party signs. If the processor has already started handling the data, use today's date: the agreement then governs the processing from that date onwards.\",\n        \"options\": [],\n        \"mappings\": [\n          \"390941aa-adb7-4841-b716-fe87cd3bbb6c\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Date of this agreement\\\", \\\"placeholder\\\": \\\"e.g. 15/03/2027\\\", \\\"helpText\\\": \\\"Usually the date on which the last party signs. If the processor has already started handling the data, use today's date: the agreement then governs the processing from that date onwards.\\\", \\\"mappings\\\": [\\\"390941aa-adb7-4841-b716-fe87cd3bbb6c\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"8ec9cf30-3b6a-4a3f-85bc-eb563153e876\",\n    \"stepId\": \"8ec9cf30-3b6a-4a3f-85bc-eb563153e876\",\n    \"productId\": 2093,\n    \"name\": \"The Controller (the customer)\",\n    \"order\": 2,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"stepId\": \"8ec9cf30-3b6a-4a3f-85bc-eb563153e876\",\n        \"type\": \"radio\",\n        \"label\": \"Who is the Controller (the organisation that decides why and how the data is used)?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"The controller is the organisation that decides the purposes and means of the processing, usually the customer that hires the supplier. It remains responsible to the individuals concerned and to the Information Commission. If the controller is a public authority, check first whether specific rules on contracts and transfers apply to it.\",\n        \"options\": [\n          {\n            \"value\": \"company\",\n            \"text\": \"A company, LLP or other incorporated organisation (such as a charitable company or CIO)\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"individual\",\n            \"text\": \"An individual or a firm that is not an LLP (sole trader, self-employed professional or partnership)\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"company\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Who is the Controller (the organisation that decides why and how the data is used)?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"The controller is the organisation that decides the purposes and means of the processing, usually the customer that hires the supplier. It remains responsible to the individuals concerned and to the Information Commission. If the controller is a public authority, check first whether specific rules on contracts and transfers apply to it.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true,\n        \"computations\": [\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"42b2c260-cd5c-4e43-a89a-a6b3f241947c\",\n            \"args\": [\n              \"S01\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"4f5ef0e2-6c03-46d3-8b2b-2c832bc26a23\",\n            \"args\": [\n              \"S02\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"8441f0d5-2a82-4c67-a6d9-de7d0a1907eb\",\n            \"args\": [\n              \"S03\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"bacba635-b19e-4f71-9375-631bdd6cd9c4\",\n            \"args\": [\n              \"S04\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"bb22c8d9-6816-400f-9a71-c1df1ea39910\",\n            \"args\": [\n              \"S05\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"38c8087b-94d4-497c-8cb9-0fd7a35c6f01\",\n            \"args\": [\n              \"S06\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"d1701cdd-acab-4ea2-9f12-f206278e08cc\",\n            \"args\": [\n              \"S07\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"d689e849-ed00-48a4-aebd-c835d8eafa7c\",\n            \"args\": [\n              \"S08\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"18cf10ea-61bf-4d0f-8221-b1b786d552d2\",\n            \"args\": [\n              \"S09\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"46b37062-b336-4034-a3fb-0c85c72aa549\",\n            \"args\": [\n              \"S10\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"5e0b325d-98e5-41ae-8055-faf2418b12c6\",\n            \"args\": [\n              \"S11\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"42d5946c-3807-4550-8c03-ee69f19a9819\",\n            \"args\": [\n              \"S12\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"ec9b2e80-be71-49aa-8bf6-9ef207ca448d\",\n            \"args\": [\n              \"S13\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"36c18466-f466-4093-a767-4cd6ab31e5bf\",\n            \"args\": [\n              \"S14\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"484bd2ec-a9fc-4c5e-a9cc-64f74fceaed9\",\n            \"args\": [\n              \"S15\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"a443e787-cfaa-4bf8-960b-2e3f555b3628\",\n            \"args\": [\n              \"S16\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"c0d04489-71e3-4adf-b7c7-00fc8742f121\",\n            \"args\": [\n              \"S17\"\n            ]\n          },\n          {\n            \"fn\": \"sectnum\",\n            \"target\": \"97be0412-d87d-44a4-abab-e059e537e617\",\n            \"args\": [\n              \"S18\"\n            ]\n          }\n        ]\n      }\n    ]\n  },\n  {\n    \"id\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n    \"stepId\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n    \"productId\": 2093,\n    \"name\": \"The Controller: organisation details\",\n    \"order\": 3,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"individual\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"1a7fd57e-6f10-4787-bc41-c70e2c8bd578\",\n        \"stepId\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n        \"type\": \"text\",\n        \"label\": \"Full registered name of the Controller\",\n        \"placeholder\": \"e.g. Greenfield Dental Care Ltd\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"ef2af697-a2f3-461d-b824-25f6aa08a2b8\",\n          \"c9781c2d-0c4f-46a0-b390-6a8afa21b833\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full registered name of the Controller\\\", \\\"placeholder\\\": \\\"e.g. Greenfield Dental Care Ltd\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"ef2af697-a2f3-461d-b824-25f6aa08a2b8\\\", \\\"c9781c2d-0c4f-46a0-b390-6a8afa21b833\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"5c8284ca-e4b1-4a6f-944f-d79f293a2f1b\",\n        \"stepId\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n        \"type\": \"text\",\n        \"label\": \"Where is the Controller registered?\",\n        \"placeholder\": \"e.g. England and Wales\",\n        \"helpText\": \"The country or register where it is incorporated or registered: \\\"England and Wales\\\" for most companies registered at Companies House, or the country concerned for an organisation registered abroad.\",\n        \"options\": [],\n        \"mappings\": [\n          \"a3468e59-05de-4b0d-a1ff-4b6cac11f0cd\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Where is the Controller registered?\\\", \\\"placeholder\\\": \\\"e.g. England and Wales\\\", \\\"helpText\\\": \\\"The country or register where it is incorporated or registered: \\\\\\\"England and Wales\\\\\\\" for most companies registered at Companies House, or the country concerned for an organisation registered abroad.\\\", \\\"mappings\\\": [\\\"a3468e59-05de-4b0d-a1ff-4b6cac11f0cd\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"e72d976c-3236-4596-b60e-69fc48a4db1c\",\n        \"stepId\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n        \"type\": \"text\",\n        \"label\": \"Registered number of the Controller\",\n        \"placeholder\": \"e.g. 09876543\",\n        \"helpText\": \"The company or LLP number on the Companies House register, or the charity number for a CIO. For a foreign organisation, its number on its local register.\",\n        \"options\": [],\n        \"mappings\": [\n          \"a894427c-1d5f-43a8-9066-b733a01824eb\"\n        ],\n        \"value\": \"\",\n        \"order\": 3,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 3,\n        \"content\": \"{\\\"label\\\": \\\"Registered number of the Controller\\\", \\\"placeholder\\\": \\\"e.g. 09876543\\\", \\\"helpText\\\": \\\"The company or LLP number on the Companies House register, or the charity number for a CIO. For a foreign organisation, its number on its local register.\\\", \\\"mappings\\\": [\\\"a894427c-1d5f-43a8-9066-b733a01824eb\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"b857b20e-22e2-4f9c-b15f-d7815ab0c88c\",\n        \"stepId\": \"134b5bc7-e04d-4fef-94bd-d7d426c20be3\",\n        \"type\": \"text\",\n        \"label\": \"Registered office (or principal office) address of the Controller\",\n        \"placeholder\": \"e.g. 12 Market Street, Leeds LS1 6DT\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"bc0a732a-1507-45c6-91d8-8e994128b40f\"\n        ],\n        \"value\": \"\",\n        \"order\": 4,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 4,\n        \"content\": \"{\\\"label\\\": \\\"Registered office (or principal office) address of the Controller\\\", \\\"placeholder\\\": \\\"e.g. 12 Market Street, Leeds LS1 6DT\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"bc0a732a-1507-45c6-91d8-8e994128b40f\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"867f8d60-7e41-40af-a4b8-f5cd3cca0846\",\n    \"stepId\": \"867f8d60-7e41-40af-a4b8-f5cd3cca0846\",\n    \"productId\": 2093,\n    \"name\": \"The Controller: signatory\",\n    \"order\": 4,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"individual\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"a1e35be1-da8e-4b5c-8dd5-8710dcc7f6b6\",\n        \"stepId\": \"867f8d60-7e41-40af-a4b8-f5cd3cca0846\",\n        \"type\": \"text\",\n        \"label\": \"Full name of the person signing for the Controller\",\n        \"placeholder\": \"e.g. Sarah Patel\",\n        \"helpText\": \"A director, a member of an LLP, a trustee or another person authorised to sign contracts for the organisation.\",\n        \"options\": [],\n        \"mappings\": [\n          \"78e41aa3-0d34-4b32-8d08-524e6012e9f7\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full name of the person signing for the Controller\\\", \\\"placeholder\\\": \\\"e.g. Sarah Patel\\\", \\\"helpText\\\": \\\"A director, a member of an LLP, a trustee or another person authorised to sign contracts for the organisation.\\\", \\\"mappings\\\": [\\\"78e41aa3-0d34-4b32-8d08-524e6012e9f7\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"f4bb75e3-9012-4178-a043-be461c72c7d5\",\n        \"stepId\": \"867f8d60-7e41-40af-a4b8-f5cd3cca0846\",\n        \"type\": \"text\",\n        \"label\": \"Position of the person signing for the Controller\",\n        \"placeholder\": \"e.g. Director\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"d8b62dae-61ca-44a0-93a1-1e090a75d60e\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Position of the person signing for the Controller\\\", \\\"placeholder\\\": \\\"e.g. Director\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"d8b62dae-61ca-44a0-93a1-1e090a75d60e\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"b61f9625-6550-4ff5-9cab-6f393fec5e21\",\n    \"stepId\": \"b61f9625-6550-4ff5-9cab-6f393fec5e21\",\n    \"productId\": 2093,\n    \"name\": \"The Controller: individual\",\n    \"order\": 5,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"b86ab78f-d84f-4752-9f0a-404b467db1a7\",\n        \"value\": \"company\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"5ab32cc1-1c3a-4786-9e92-d98d8d99a119\",\n        \"stepId\": \"b61f9625-6550-4ff5-9cab-6f393fec5e21\",\n        \"type\": \"text\",\n        \"label\": \"Full name of the Controller (with any trading name)\",\n        \"placeholder\": \"e.g. Dr Tom Hughes, trading as Hughes Physiotherapy\",\n        \"helpText\": \"For a partnership that is not an LLP, enter the names of the partners followed by \\\"trading as\\\" and the firm name; one of the partners signs. An unincorporated charity or association cannot contract in its own name: enter the trustees' names followed by \\\"as trustees of\\\" and the charity's name.\",\n        \"options\": [],\n        \"mappings\": [\n          \"23862644-5785-4af5-be76-1b5dd9be9778\",\n          \"056c7707-f262-47bf-b66e-f887e5a73359\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full name of the Controller (with any trading name)\\\", \\\"placeholder\\\": \\\"e.g. Dr Tom Hughes, trading as Hughes Physiotherapy\\\", \\\"helpText\\\": \\\"For a partnership that is not an LLP, enter the names of the partners followed by \\\\\\\"trading as\\\\\\\" and the firm name; one of the partners signs. An unincorporated charity or association cannot contract in its own name: enter the trustees' names followed by \\\\\\\"as trustees of\\\\\\\" and the charity's name.\\\", \\\"mappings\\\": [\\\"23862644-5785-4af5-be76-1b5dd9be9778\\\", \\\"056c7707-f262-47bf-b66e-f887e5a73359\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"97d884f3-7246-454f-a66f-749958593713\",\n        \"stepId\": \"b61f9625-6550-4ff5-9cab-6f393fec5e21\",\n        \"type\": \"text\",\n        \"label\": \"Business address of the Controller\",\n        \"placeholder\": \"e.g. 4 Station Road, Bath BA1 1SR\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"7fa8d025-0c13-4f64-8fb4-31a69a1da790\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Business address of the Controller\\\", \\\"placeholder\\\": \\\"e.g. 4 Station Road, Bath BA1 1SR\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"7fa8d025-0c13-4f64-8fb4-31a69a1da790\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"f200e0f9-437c-4067-9cca-831f283958b0\",\n    \"stepId\": \"f200e0f9-437c-4067-9cca-831f283958b0\",\n    \"productId\": 2093,\n    \"name\": \"The Processor (the supplier)\",\n    \"order\": 6,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"stepId\": \"f200e0f9-437c-4067-9cca-831f283958b0\",\n        \"type\": \"radio\",\n        \"label\": \"Who is the Processor (the supplier that handles the data on the Controller's behalf)?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"The processor handles personal data only on behalf of the controller: for example an IT support company, a cloud or hosting provider, a payroll bureau, an email marketing platform, a call centre or a document storage firm. A supplier based outside the UK can sign it too: enter its country of registration on the next screen.\",\n        \"options\": [\n          {\n            \"value\": \"company\",\n            \"text\": \"A company, LLP or other incorporated organisation (such as a charitable company or CIO)\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"individual\",\n            \"text\": \"An individual or a firm that is not an LLP (sole trader, self-employed professional or partnership)\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"company\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Who is the Processor (the supplier that handles the data on the Controller's behalf)?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"The processor handles personal data only on behalf of the controller: for example an IT support company, a cloud or hosting provider, a payroll bureau, an email marketing platform, a call centre or a document storage firm. A supplier based outside the UK can sign it too: enter its country of registration on the next screen.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n    \"stepId\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n    \"productId\": 2093,\n    \"name\": \"The Processor: organisation details\",\n    \"order\": 7,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"individual\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"7692d2b6-1e8b-464e-9ea2-1aba16889427\",\n        \"stepId\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n        \"type\": \"text\",\n        \"label\": \"Full registered name of the Processor\",\n        \"placeholder\": \"e.g. Northbridge IT Services Ltd\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"9ad97eec-a075-423b-91f3-a10665a5cc0a\",\n          \"7c30029e-906f-460a-9f8e-80433de65a08\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full registered name of the Processor\\\", \\\"placeholder\\\": \\\"e.g. Northbridge IT Services Ltd\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"9ad97eec-a075-423b-91f3-a10665a5cc0a\\\", \\\"7c30029e-906f-460a-9f8e-80433de65a08\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"b9f72a9f-7da2-478e-8446-91b75ce3101b\",\n        \"stepId\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n        \"type\": \"text\",\n        \"label\": \"Where is the Processor registered?\",\n        \"placeholder\": \"e.g. England and Wales\",\n        \"helpText\": \"The country or register where it is incorporated or registered: \\\"England and Wales\\\" for most companies registered at Companies House, or the country concerned for an organisation registered abroad.\",\n        \"options\": [],\n        \"mappings\": [\n          \"f15f6efd-af8b-47f3-ad54-2dd9494991b1\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Where is the Processor registered?\\\", \\\"placeholder\\\": \\\"e.g. England and Wales\\\", \\\"helpText\\\": \\\"The country or register where it is incorporated or registered: \\\\\\\"England and Wales\\\\\\\" for most companies registered at Companies House, or the country concerned for an organisation registered abroad.\\\", \\\"mappings\\\": [\\\"f15f6efd-af8b-47f3-ad54-2dd9494991b1\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"60141889-ae26-40c5-a6f6-986612468ff2\",\n        \"stepId\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n        \"type\": \"text\",\n        \"label\": \"Registered number of the Processor\",\n        \"placeholder\": \"e.g. 12345678\",\n        \"helpText\": \"The company or LLP number on the Companies House register, or the charity number for a CIO. For a foreign organisation, its number on its local register.\",\n        \"options\": [],\n        \"mappings\": [\n          \"8af13ddc-118e-4e42-8243-5449475146c5\"\n        ],\n        \"value\": \"\",\n        \"order\": 3,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 3,\n        \"content\": \"{\\\"label\\\": \\\"Registered number of the Processor\\\", \\\"placeholder\\\": \\\"e.g. 12345678\\\", \\\"helpText\\\": \\\"The company or LLP number on the Companies House register, or the charity number for a CIO. For a foreign organisation, its number on its local register.\\\", \\\"mappings\\\": [\\\"8af13ddc-118e-4e42-8243-5449475146c5\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"d6620c1d-d76f-407f-aa1f-432f3f1b0c58\",\n        \"stepId\": \"f682fc0c-e3e9-4f59-a6a3-7bb709cfe16f\",\n        \"type\": \"text\",\n        \"label\": \"Registered office (or principal office) address of the Processor\",\n        \"placeholder\": \"e.g. Unit 5, Kings Park, Manchester M1 2AB\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"7d2df7ae-531a-4ca4-af1e-de0f7b72cb3f\"\n        ],\n        \"value\": \"\",\n        \"order\": 4,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 4,\n        \"content\": \"{\\\"label\\\": \\\"Registered office (or principal office) address of the Processor\\\", \\\"placeholder\\\": \\\"e.g. Unit 5, Kings Park, Manchester M1 2AB\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"7d2df7ae-531a-4ca4-af1e-de0f7b72cb3f\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"79b22573-4f26-42d6-add5-7bde6d71b6c8\",\n    \"stepId\": \"79b22573-4f26-42d6-add5-7bde6d71b6c8\",\n    \"productId\": 2093,\n    \"name\": \"The Processor: signatory\",\n    \"order\": 8,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"individual\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"ca2a2c2c-fca6-48a2-9df2-a22c2ba3246b\",\n        \"stepId\": \"79b22573-4f26-42d6-add5-7bde6d71b6c8\",\n        \"type\": \"text\",\n        \"label\": \"Full name of the person signing for the Processor\",\n        \"placeholder\": \"e.g. James O'Connor\",\n        \"helpText\": \"A director, a member of an LLP, a trustee or another person authorised to sign contracts for the organisation.\",\n        \"options\": [],\n        \"mappings\": [\n          \"fe7b57cb-73ca-4f5e-b12c-17c15cdabfa6\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full name of the person signing for the Processor\\\", \\\"placeholder\\\": \\\"e.g. James O'Connor\\\", \\\"helpText\\\": \\\"A director, a member of an LLP, a trustee or another person authorised to sign contracts for the organisation.\\\", \\\"mappings\\\": [\\\"fe7b57cb-73ca-4f5e-b12c-17c15cdabfa6\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"1a91d344-c92e-4e77-af9e-850d7dd6b045\",\n        \"stepId\": \"79b22573-4f26-42d6-add5-7bde6d71b6c8\",\n        \"type\": \"text\",\n        \"label\": \"Position of the person signing for the Processor\",\n        \"placeholder\": \"e.g. Managing Director\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"9e82bfbe-7601-4bff-9b06-355c8b9c5270\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Position of the person signing for the Processor\\\", \\\"placeholder\\\": \\\"e.g. Managing Director\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"9e82bfbe-7601-4bff-9b06-355c8b9c5270\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"fd7358cf-8508-4a5e-9540-79f9ea93e607\",\n    \"stepId\": \"fd7358cf-8508-4a5e-9540-79f9ea93e607\",\n    \"productId\": 2093,\n    \"name\": \"The Processor: individual\",\n    \"order\": 9,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"9ad020bf-a461-45f2-8c31-b00a4e2dbb7b\",\n        \"value\": \"company\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"15940a87-2ff2-4ad7-a24a-96c1f6d596a7\",\n        \"stepId\": \"fd7358cf-8508-4a5e-9540-79f9ea93e607\",\n        \"type\": \"text\",\n        \"label\": \"Full name of the Processor (with any trading name)\",\n        \"placeholder\": \"e.g. Amira Khan, trading as AK Bookkeeping\",\n        \"helpText\": \"For a partnership that is not an LLP, enter the names of the partners followed by \\\"trading as\\\" and the firm name; one of the partners signs. An unincorporated charity or association cannot contract in its own name: enter the trustees' names followed by \\\"as trustees of\\\" and the charity's name.\",\n        \"options\": [],\n        \"mappings\": [\n          \"cf9ae694-66ec-40c0-bcb1-0101abfac742\",\n          \"8e066ff0-7b0c-4b2a-bc03-60b88760ffc8\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Full name of the Processor (with any trading name)\\\", \\\"placeholder\\\": \\\"e.g. Amira Khan, trading as AK Bookkeeping\\\", \\\"helpText\\\": \\\"For a partnership that is not an LLP, enter the names of the partners followed by \\\\\\\"trading as\\\\\\\" and the firm name; one of the partners signs. An unincorporated charity or association cannot contract in its own name: enter the trustees' names followed by \\\\\\\"as trustees of\\\\\\\" and the charity's name.\\\", \\\"mappings\\\": [\\\"cf9ae694-66ec-40c0-bcb1-0101abfac742\\\", \\\"8e066ff0-7b0c-4b2a-bc03-60b88760ffc8\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"6ded6373-7aab-49e3-8f6f-1254040e4046\",\n        \"stepId\": \"fd7358cf-8508-4a5e-9540-79f9ea93e607\",\n        \"type\": \"text\",\n        \"label\": \"Business address of the Processor\",\n        \"placeholder\": \"e.g. 27 High Street, Cardiff CF10 1AA\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"efe07007-10d1-4dc5-a772-88da9b551fea\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Business address of the Processor\\\", \\\"placeholder\\\": \\\"e.g. 27 High Street, Cardiff CF10 1AA\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"efe07007-10d1-4dc5-a772-88da9b551fea\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"1b25e6ee-65d9-4ead-823f-9c7fa4a9b280\",\n    \"stepId\": \"1b25e6ee-65d9-4ead-823f-9c7fa4a9b280\",\n    \"productId\": 2093,\n    \"name\": \"The main services agreement\",\n    \"order\": 10,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"5d213d54-08e8-4e75-945d-8c3f67220e78\",\n        \"stepId\": \"1b25e6ee-65d9-4ead-823f-9c7fa4a9b280\",\n        \"type\": \"radio\",\n        \"label\": \"Is there a written contract for the services themselves (the main agreement)?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"This agreement adds the data protection terms to the contract under which the supplier provides its services (for example an IT support, hosting, software or payroll contract). It does not replace that contract. If there is no single signed contract, the agreement refers to whatever quotation, order or terms of business apply.\",\n        \"options\": [\n          {\n            \"value\": \"yes\",\n            \"text\": \"Yes, a signed services agreement or contract\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"no\",\n            \"text\": \"No, the services are provided under a quotation, order form or terms of business\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"yes\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Is there a written contract for the services themselves (the main agreement)?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"This agreement adds the data protection terms to the contract under which the supplier provides its services (for example an IT support, hosting, software or payroll contract). It does not replace that contract. If there is no single signed contract, the agreement refers to whatever quotation, order or terms of business apply.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"7806ab68-31d8-4ace-adc0-17b63faa4a56\",\n    \"stepId\": \"7806ab68-31d8-4ace-adc0-17b63faa4a56\",\n    \"productId\": 2093,\n    \"name\": \"Main agreement details\",\n    \"order\": 11,\n    \"isDefault\": true,\n    \"displayCondition\": [\n      {\n        \"field\": \"5d213d54-08e8-4e75-945d-8c3f67220e78\",\n        \"value\": \"no\",\n        \"type\": \"remove\",\n        \"operator\": \"=\"\n      }\n    ],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"3b100854-29a2-4a28-8c87-a47abca84ad7\",\n        \"stepId\": \"7806ab68-31d8-4ace-adc0-17b63faa4a56\",\n        \"type\": \"text\",\n        \"label\": \"Title of the main agreement\",\n        \"placeholder\": \"e.g. IT Managed Services Agreement\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"17330e0c-0f10-4ea1-8177-4979fd676a4c\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Title of the main agreement\\\", \\\"placeholder\\\": \\\"e.g. IT Managed Services Agreement\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"17330e0c-0f10-4ea1-8177-4979fd676a4c\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"959f1b27-9343-45a8-9714-25ef840a0ac9\",\n        \"stepId\": \"7806ab68-31d8-4ace-adc0-17b63faa4a56\",\n        \"type\": \"date\",\n        \"label\": \"Date of the main agreement\",\n        \"placeholder\": \"e.g. 15/03/2027\",\n        \"helpText\": \"The date shown on the contract, or the date of the last signature if it is not dated.\",\n        \"options\": [],\n        \"mappings\": [\n          \"0ccf460c-cff0-4d8a-a9f6-b7763c949f3b\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Date of the main agreement\\\", \\\"placeholder\\\": \\\"e.g. 15/03/2027\\\", \\\"helpText\\\": \\\"The date shown on the contract, or the date of the last signature if it is not dated.\\\", \\\"mappings\\\": [\\\"0ccf460c-cff0-4d8a-a9f6-b7763c949f3b\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"5eaa1e02-cfed-4117-a54f-b72d0f42ec17\",\n    \"stepId\": \"5eaa1e02-cfed-4117-a54f-b72d0f42ec17\",\n    \"productId\": 2093,\n    \"name\": \"The services and the processing\",\n    \"order\": 12,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"9431fe66-3240-4472-8130-76d52e273fea\",\n        \"stepId\": \"5eaa1e02-cfed-4117-a54f-b72d0f42ec17\",\n        \"type\": \"textarea\",\n        \"label\": \"What services does the Processor provide?\",\n        \"placeholder\": \"e.g. hosting, maintenance and support of the Controller's practice management software and IT systems, including remote support and daily back-ups\",\n        \"helpText\": \"This describes the subject matter of the processing, which Article 28(3) of the UK GDPR requires the agreement to state. Describe the services in a sentence or two.\",\n        \"options\": [],\n        \"mappings\": [\n          \"e98853be-1698-4304-86cd-d2c66f2818b0\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"What services does the Processor provide?\\\", \\\"placeholder\\\": \\\"e.g. hosting, maintenance and support of the Controller's practice management software and IT systems, including remote support and daily back-ups\\\", \\\"helpText\\\": \\\"This describes the subject matter of the processing, which Article 28(3) of the UK GDPR requires the agreement to state. Describe the services in a sentence or two.\\\", \\\"mappings\\\": [\\\"e98853be-1698-4304-86cd-d2c66f2818b0\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"6739df95-f3b2-4c6f-bc63-7ad071853007\",\n        \"stepId\": \"5eaa1e02-cfed-4117-a54f-b72d0f42ec17\",\n        \"type\": \"textarea\",\n        \"label\": \"What will the Processor do with the personal data?\",\n        \"placeholder\": \"e.g. storing, hosting, backing up, accessing for support purposes, restoring and deleting\",\n        \"helpText\": \"The nature of the processing: the operations the supplier carries out, such as collecting, recording, storing, organising, consulting, analysing, sending, printing or deleting data.\",\n        \"options\": [],\n        \"mappings\": [\n          \"abe3638d-f758-4796-be0f-ae45c4354845\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"What will the Processor do with the personal data?\\\", \\\"placeholder\\\": \\\"e.g. storing, hosting, backing up, accessing for support purposes, restoring and deleting\\\", \\\"helpText\\\": \\\"The nature of the processing: the operations the supplier carries out, such as collecting, recording, storing, organising, consulting, analysing, sending, printing or deleting data.\\\", \\\"mappings\\\": [\\\"abe3638d-f758-4796-be0f-ae45c4354845\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"6918a663-315a-4458-a704-dc1325a1932f\",\n        \"stepId\": \"5eaa1e02-cfed-4117-a54f-b72d0f42ec17\",\n        \"type\": \"textarea\",\n        \"label\": \"For what purpose?\",\n        \"placeholder\": \"e.g. to provide and support the Controller's IT systems so that it can manage patient appointments and records\",\n        \"helpText\": \"Why the processing takes place: the business purpose of the Controller that the services support. The Processor may not use the data for its own purposes.\",\n        \"options\": [],\n        \"mappings\": [\n          \"9a383304-c54f-4e4b-b565-6c5c5b7f0e38\"\n        ],\n        \"value\": \"\",\n        \"order\": 3,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 3,\n        \"content\": \"{\\\"label\\\": \\\"For what purpose?\\\", \\\"placeholder\\\": \\\"e.g. to provide and support the Controller's IT systems so that it can manage patient appointments and records\\\", \\\"helpText\\\": \\\"Why the processing takes place: the business purpose of the Controller that the services support. The Processor may not use the data for its own purposes.\\\", \\\"mappings\\\": [\\\"9a383304-c54f-4e4b-b565-6c5c5b7f0e38\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"3e173a50-7fcf-495d-9a72-76a6410889ca\",\n    \"stepId\": \"3e173a50-7fcf-495d-9a72-76a6410889ca\",\n    \"productId\": 2093,\n    \"name\": \"The personal data\",\n    \"order\": 13,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"58bcd020-3208-4a05-83e0-91b35bd0c98e\",\n        \"stepId\": \"3e173a50-7fcf-495d-9a72-76a6410889ca\",\n        \"type\": \"textarea\",\n        \"label\": \"What types of personal data are involved?\",\n        \"placeholder\": \"e.g. names, contact details, dates of birth, appointment history, payment details\",\n        \"helpText\": \"List the kinds of information. Sensitive data (health, ethnic origin, religion, biometrics, sexual life or orientation, trade union membership, political opinions, genetic data, criminal records) is dealt with on the next screen.\",\n        \"options\": [],\n        \"mappings\": [\n          \"1f4c842f-32bb-4b6e-9f14-6d5895a6c09c\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"What types of personal data are involved?\\\", \\\"placeholder\\\": \\\"e.g. names, contact details, dates of birth, appointment history, payment details\\\", \\\"helpText\\\": \\\"List the kinds of information. Sensitive data (health, ethnic origin, religion, biometrics, sexual life or orientation, trade union membership, political opinions, genetic data, criminal records) is dealt with on the next screen.\\\", \\\"mappings\\\": [\\\"1f4c842f-32bb-4b6e-9f14-6d5895a6c09c\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"de1d222f-682a-438a-8719-34e427b0a510\",\n        \"stepId\": \"3e173a50-7fcf-495d-9a72-76a6410889ca\",\n        \"type\": \"textarea\",\n        \"label\": \"Whose personal data is it?\",\n        \"placeholder\": \"e.g. the Controller's patients, employees and suppliers' contact persons\",\n        \"helpText\": \"The categories of individuals concerned (the data subjects), for example customers, website users, employees, job applicants, patients, pupils or members.\",\n        \"options\": [],\n        \"mappings\": [\n          \"8056a543-47bb-40b5-a774-0a6d9e9de26b\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Whose personal data is it?\\\", \\\"placeholder\\\": \\\"e.g. the Controller's patients, employees and suppliers' contact persons\\\", \\\"helpText\\\": \\\"The categories of individuals concerned (the data subjects), for example customers, website users, employees, job applicants, patients, pupils or members.\\\", \\\"mappings\\\": [\\\"8056a543-47bb-40b5-a774-0a6d9e9de26b\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"c255c1b6-8d1a-467d-b6c6-10dc87c6ba4e\",\n    \"stepId\": \"c255c1b6-8d1a-467d-b6c6-10dc87c6ba4e\",\n    \"productId\": 2093,\n    \"name\": \"Sensitive data\",\n    \"order\": 14,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n        \"stepId\": \"c255c1b6-8d1a-467d-b6c6-10dc87c6ba4e\",\n        \"type\": \"radio\",\n        \"label\": \"Does the data include special category data or criminal offence data?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"Special category data means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person, health data and data about a person's sex life or sexual orientation (Article 9 of the UK GDPR). Criminal offence data covers convictions, offences and related security measures (Article 10). Answering \\\"Yes\\\" adds enhanced security measures.\",\n        \"options\": [\n          {\n            \"value\": \"no\",\n            \"text\": \"No\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"yes\",\n            \"text\": \"Yes\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"no\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Does the data include special category data or criminal offence data?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"Special category data means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person, health data and data about a person's sex life or sexual orientation (Article 9 of the UK GDPR). Criminal offence data covers convictions, offences and related security measures (Article 10). Answering \\\\\\\"Yes\\\\\\\" adds enhanced security measures.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n              \"value\": \"yes\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"70e947e8-a631-41d4-9fa9-56f5ecccf5e5\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"bc512784-fd5e-4f62-b45e-35d3d9d979b9\",\n              \"value\": \"no\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"70e947e8-a631-41d4-9fa9-56f5ecccf5e5\"\n          }\n        ]\n      },\n      {\n        \"id\": \"70e947e8-a631-41d4-9fa9-56f5ecccf5e5\",\n        \"stepId\": \"c255c1b6-8d1a-467d-b6c6-10dc87c6ba4e\",\n        \"type\": \"textarea\",\n        \"label\": \"Which sensitive data?\",\n        \"placeholder\": \"e.g. health data (medical history, treatment notes and test results)\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"2e4e34a0-4ed6-4021-aa3c-b743632b389a\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Which sensitive data?\\\", \\\"placeholder\\\": \\\"e.g. health data (medical history, treatment notes and test results)\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"2e4e34a0-4ed6-4021-aa3c-b743632b389a\\\"]}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"initiallyHidden\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"582f477c-4b7f-4714-82d0-4cbe81f8a24c\",\n    \"stepId\": \"582f477c-4b7f-4714-82d0-4cbe81f8a24c\",\n    \"productId\": 2093,\n    \"name\": \"Duration of the processing\",\n    \"order\": 15,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n        \"stepId\": \"582f477c-4b7f-4714-82d0-4cbe81f8a24c\",\n        \"type\": \"radio\",\n        \"label\": \"How long may the Processor process the data?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"The duration of the processing must be stated in the agreement. In both cases the Processor must then return or delete the data.\",\n        \"options\": [\n          {\n            \"value\": \"services\",\n            \"text\": \"For as long as it provides the services\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"date\",\n            \"text\": \"Until a fixed date\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"services\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"How long may the Processor process the data?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"The duration of the processing must be stated in the agreement. In both cases the Processor must then return or delete the data.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n              \"value\": \"date\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"71476b00-cf4b-4559-a548-ad6d15f07d6c\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"5fc2c625-19c3-4b3f-b985-bb7c39483365\",\n              \"value\": \"services\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"71476b00-cf4b-4559-a548-ad6d15f07d6c\"\n          }\n        ]\n      },\n      {\n        \"id\": \"71476b00-cf4b-4559-a548-ad6d15f07d6c\",\n        \"stepId\": \"582f477c-4b7f-4714-82d0-4cbe81f8a24c\",\n        \"type\": \"date\",\n        \"label\": \"End date of the processing\",\n        \"placeholder\": \"e.g. 15/03/2027\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"00915b70-fd16-4b84-9dde-38f9414a62db\",\n          \"0275c034-0bbb-4a37-a31a-8aa2e70668b2\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"End date of the processing\\\", \\\"placeholder\\\": \\\"e.g. 15/03/2027\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"00915b70-fd16-4b84-9dde-38f9414a62db\\\", \\\"0275c034-0bbb-4a37-a31a-8aa2e70668b2\\\"]}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"initiallyHidden\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"aa689322-2940-4838-84a2-990353392c45\",\n    \"stepId\": \"aa689322-2940-4838-84a2-990353392c45\",\n    \"productId\": 2093,\n    \"name\": \"Security measures\",\n    \"order\": 16,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"078a6515-6559-46be-9b6c-878f7f1f8a35\",\n        \"stepId\": \"aa689322-2940-4838-84a2-990353392c45\",\n        \"type\": \"radio\",\n        \"label\": \"Which security measures should the Processor apply?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"Annex 2 lists the measures expected under Article 32 of the UK GDPR (access control, multi-factor authentication, encryption, back-ups, patching, logging, training, incident management and testing). Add specific measures if the supplier has agreed to them, for example a certification or a hosting location.\",\n        \"options\": [\n          {\n            \"value\": \"standard\",\n            \"text\": \"The standard measures listed in Annex 2\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"additional\",\n            \"text\": \"The standard measures plus additional measures\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"standard\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Which security measures should the Processor apply?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"Annex 2 lists the measures expected under Article 32 of the UK GDPR (access control, multi-factor authentication, encryption, back-ups, patching, logging, training, incident management and testing). Add specific measures if the supplier has agreed to them, for example a certification or a hosting location.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"078a6515-6559-46be-9b6c-878f7f1f8a35\",\n              \"value\": \"additional\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"6c7e9ffc-fe5e-4a8e-8bf6-a67fdf7ae749\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"078a6515-6559-46be-9b6c-878f7f1f8a35\",\n              \"value\": \"standard\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"6c7e9ffc-fe5e-4a8e-8bf6-a67fdf7ae749\"\n          }\n        ]\n      },\n      {\n        \"id\": \"6c7e9ffc-fe5e-4a8e-8bf6-a67fdf7ae749\",\n        \"stepId\": \"aa689322-2940-4838-84a2-990353392c45\",\n        \"type\": \"textarea\",\n        \"label\": \"Additional security measures\",\n        \"placeholder\": \"e.g. ISO/IEC 27001 certification maintained throughout the term; data hosted only in UK data centres; annual penetration test by an independent firm\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"7691b849-cb2c-4187-9403-c08655b58270\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Additional security measures\\\", \\\"placeholder\\\": \\\"e.g. ISO/IEC 27001 certification maintained throughout the term; data hosted only in UK data centres; annual penetration test by an independent firm\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"7691b849-cb2c-4187-9403-c08655b58270\\\"]}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"initiallyHidden\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"38a62a63-be3c-47ea-bc94-5cec571db348\",\n    \"stepId\": \"38a62a63-be3c-47ea-bc94-5cec571db348\",\n    \"productId\": 2093,\n    \"name\": \"Sub-processors\",\n    \"order\": 17,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n        \"stepId\": \"38a62a63-be3c-47ea-bc94-5cec571db348\",\n        \"type\": \"radio\",\n        \"label\": \"May the Processor use sub-processors (its own suppliers that access the data)?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"Under Article 28(2) of the UK GDPR, a processor needs the controller's prior specific or general written authorisation to engage another processor. With a general authorisation the supplier must announce any new or replacement sub-processor in advance, and the Controller may object. Most cloud and software suppliers work this way.\",\n        \"options\": [\n          {\n            \"value\": \"none\",\n            \"text\": \"No, not without the Controller's specific written authorisation each time\",\n            \"isDefault\": false\n          },\n          {\n            \"value\": \"specific\",\n            \"text\": \"Only the sub-processors listed (specific authorisation)\",\n            \"isDefault\": false\n          },\n          {\n            \"value\": \"general\",\n            \"text\": \"Yes: the sub-processors listed, and others after 30 days' notice (general authorisation)\",\n            \"isDefault\": true\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"general\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"May the Processor use sub-processors (its own suppliers that access the data)?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"Under Article 28(2) of the UK GDPR, a processor needs the controller's prior specific or general written authorisation to engage another processor. With a general authorisation the supplier must announce any new or replacement sub-processor in advance, and the Controller may object. Most cloud and software suppliers work this way.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n              \"value\": \"specific\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"2b4fb333-73e9-4ec3-8b3a-05eee0976e25\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n              \"value\": \"general\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"2b4fb333-73e9-4ec3-8b3a-05eee0976e25\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"53400378-82b7-4344-8ced-2c9e67dc516f\",\n              \"value\": \"none\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"2b4fb333-73e9-4ec3-8b3a-05eee0976e25\"\n          }\n        ]\n      },\n      {\n        \"id\": \"2b4fb333-73e9-4ec3-8b3a-05eee0976e25\",\n        \"stepId\": \"38a62a63-be3c-47ea-bc94-5cec571db348\",\n        \"type\": \"textarea\",\n        \"label\": \"Sub-processors authorised now (name, service, location)\",\n        \"placeholder\": \"e.g. Datasafe Backup Ltd (off-site back-ups, UK); Hostline Ltd (cloud hosting, UK)\",\n        \"helpText\": \"If a sub-processor is located, stores data or provides support outside the UK (including in the EEA or the United States), also answer \\\"Yes\\\" to the next question on transfers and describe that transfer.\",\n        \"options\": [],\n        \"mappings\": [\n          \"a5dc8207-fe45-48f2-85b7-8ee486bdf9c0\",\n          \"13d3e679-acc8-4a07-8b77-a2251cf6dc1c\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Sub-processors authorised now (name, service, location)\\\", \\\"placeholder\\\": \\\"e.g. Datasafe Backup Ltd (off-site back-ups, UK); Hostline Ltd (cloud hosting, UK)\\\", \\\"helpText\\\": \\\"If a sub-processor is located, stores data or provides support outside the UK (including in the EEA or the United States), also answer \\\\\\\"Yes\\\\\\\" to the next question on transfers and describe that transfer.\\\", \\\"mappings\\\": [\\\"a5dc8207-fe45-48f2-85b7-8ee486bdf9c0\\\", \\\"13d3e679-acc8-4a07-8b77-a2251cf6dc1c\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"ffb65964-f9c8-46d2-b7c2-f75ade58e614\",\n    \"stepId\": \"ffb65964-f9c8-46d2-b7c2-f75ade58e614\",\n    \"productId\": 2093,\n    \"name\": \"Transfers outside the UK\",\n    \"order\": 18,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n        \"stepId\": \"ffb65964-f9c8-46d2-b7c2-f75ade58e614\",\n        \"type\": \"radio\",\n        \"label\": \"Will the personal data be transferred outside the UK, or accessed from outside the UK?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"A transfer outside the UK is allowed only if it is approved by UK regulations (for example to the EEA) or protected by appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with an assessment that protection is not materially lower than in the UK. Answer \\\"Yes\\\" if the Processor itself is based outside the UK, or if a sub-processor or another organisation abroad (such as a group company or a contractor) can access the data. Remote access by the Processor's own employees while abroad is not in itself a transfer, but the security measures still apply.\",\n        \"options\": [\n          {\n            \"value\": \"no\",\n            \"text\": \"No\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"yes\",\n            \"text\": \"Yes\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"no\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Will the personal data be transferred outside the UK, or accessed from outside the UK?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"A transfer outside the UK is allowed only if it is approved by UK regulations (for example to the EEA) or protected by appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with an assessment that protection is not materially lower than in the UK. Answer \\\\\\\"Yes\\\\\\\" if the Processor itself is based outside the UK, or if a sub-processor or another organisation abroad (such as a group company or a contractor) can access the data. Remote access by the Processor's own employees while abroad is not in itself a transfer, but the security measures still apply.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n              \"value\": \"yes\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"8f9e7b79-d681-4ff6-b391-570861470f0a\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"d60c35e5-b883-4518-99c6-f2ef5d476346\",\n              \"value\": \"no\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"8f9e7b79-d681-4ff6-b391-570861470f0a\"\n          }\n        ]\n      },\n      {\n        \"id\": \"8f9e7b79-d681-4ff6-b391-570861470f0a\",\n        \"stepId\": \"ffb65964-f9c8-46d2-b7c2-f75ade58e614\",\n        \"type\": \"textarea\",\n        \"label\": \"Which transfers (country, recipient, safeguard)?\",\n        \"placeholder\": \"e.g. to the United States, Example Cloud Inc. (hosting), under the International Data Transfer Addendum to the EU standard contractual clauses\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [\n          \"7ae41a0b-6ac6-4ab2-91cd-01065cb95f6e\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Which transfers (country, recipient, safeguard)?\\\", \\\"placeholder\\\": \\\"e.g. to the United States, Example Cloud Inc. (hosting), under the International Data Transfer Addendum to the EU standard contractual clauses\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": [\\\"7ae41a0b-6ac6-4ab2-91cd-01065cb95f6e\\\"]}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"initiallyHidden\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"06591286-89a1-43c9-8c14-d7983cddeed9\",\n    \"stepId\": \"06591286-89a1-43c9-8c14-d7983cddeed9\",\n    \"productId\": 2093,\n    \"name\": \"Breaches and assistance\",\n    \"order\": 19,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"ed466977-8c88-47ab-bea6-2884676068b5\",\n        \"stepId\": \"06591286-89a1-43c9-8c14-d7983cddeed9\",\n        \"type\": \"dropdown\",\n        \"label\": \"Deadline for the Processor to report a personal data breach\",\n        \"placeholder\": \"\",\n        \"helpText\": \"The law requires the processor to notify the controller \\\"without undue delay\\\". The controller must then notify the Information Commission without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals. A shorter deadline, such as 24 or 48 hours, gives the Controller the facts sooner and more time to assess and contain the breach.\",\n        \"options\": [\n          {\n            \"value\": \"24 hours\",\n            \"text\": \"24 hours\",\n            \"isDefault\": false\n          },\n          {\n            \"value\": \"48 hours\",\n            \"text\": \"48 hours\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"72 hours\",\n            \"text\": \"72 hours\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [\n          \"c6b7b012-980d-4b12-80ec-608bd7c11bc5\"\n        ],\n        \"value\": \"48 hours\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Deadline for the Processor to report a personal data breach\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"The law requires the processor to notify the controller \\\\\\\"without undue delay\\\\\\\". The controller must then notify the Information Commission without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals. A shorter deadline, such as 24 or 48 hours, gives the Controller the facts sooner and more time to assess and contain the breach.\\\", \\\"mappings\\\": [\\\"c6b7b012-980d-4b12-80ec-608bd7c11bc5\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"b01c7a2c-6a35-426d-b37e-88638967e1b0\",\n        \"stepId\": \"06591286-89a1-43c9-8c14-d7983cddeed9\",\n        \"type\": \"radio\",\n        \"label\": \"Is the Processor's assistance (requests from individuals, impact assessments, audits) included in its charges?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"Whichever option you choose, help with a personal data breach, and any work caused by the Processor's own breach, is never charged.\",\n        \"options\": [\n          {\n            \"value\": \"included\",\n            \"text\": \"Yes, it is included in the charges\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"chargeable\",\n            \"text\": \"No, the Processor may charge reasonable fees for it\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"included\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Is the Processor's assistance (requests from individuals, impact assessments, audits) included in its charges?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"Whichever option you choose, help with a personal data breach, and any work caused by the Processor's own breach, is never charged.\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"4c6f5704-f15e-4478-8211-2852b461fba8\",\n    \"stepId\": \"4c6f5704-f15e-4478-8211-2852b461fba8\",\n    \"productId\": 2093,\n    \"name\": \"Liability\",\n    \"order\": 20,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"b416da09-59d5-4293-a508-e82f196f5d63\",\n        \"stepId\": \"4c6f5704-f15e-4478-8211-2852b461fba8\",\n        \"type\": \"radio\",\n        \"label\": \"Limit each party's liability under this agreement?\",\n        \"placeholder\": \"\",\n        \"helpText\": \"A cap applies only between the two parties: it never limits the rights of the individuals concerned, nor liability for death or personal injury caused by negligence or for fraud. Between businesses, a cap will usually need to satisfy the reasonableness test of the Unfair Contract Terms Act 1977, and the party relying on it must show that it is reasonable (section 11(5)); the court looks in particular at the resources available to meet the liability and at insurance cover (section 11(4)).\",\n        \"options\": [\n          {\n            \"value\": \"no\",\n            \"text\": \"No, apply the limits in the main agreement, if any\",\n            \"isDefault\": true\n          },\n          {\n            \"value\": \"yes\",\n            \"text\": \"Yes, cap it at a fixed amount\",\n            \"isDefault\": false\n          }\n        ],\n        \"mappings\": [],\n        \"value\": \"no\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Limit each party's liability under this agreement?\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"A cap applies only between the two parties: it never limits the rights of the individuals concerned, nor liability for death or personal injury caused by negligence or for fraud. Between businesses, a cap will usually need to satisfy the reasonableness test of the Unfair Contract Terms Act 1977, and the party relying on it must show that it is reasonable (section 11(5)); the court looks in particular at the resources available to meet the liability and at insurance cover (section 11(4)).\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"oneline\": true,\n        \"fieldActions\": [\n          {\n            \"trigger\": {\n              \"field\": \"b416da09-59d5-4293-a508-e82f196f5d63\",\n              \"value\": \"yes\"\n            },\n            \"action\": \"show\",\n            \"fieldId\": \"c650853b-db6e-467d-8c5d-fd552fe76c14\"\n          },\n          {\n            \"trigger\": {\n              \"field\": \"b416da09-59d5-4293-a508-e82f196f5d63\",\n              \"value\": \"no\"\n            },\n            \"action\": \"hide\",\n            \"fieldId\": \"c650853b-db6e-467d-8c5d-fd552fe76c14\"\n          }\n        ]\n      },\n      {\n        \"id\": \"c650853b-db6e-467d-8c5d-fd552fe76c14\",\n        \"stepId\": \"4c6f5704-f15e-4478-8211-2852b461fba8\",\n        \"type\": \"text\",\n        \"label\": \"Amount of the cap\",\n        \"placeholder\": \"e.g. £100,000.00\",\n        \"helpText\": \"Write the amount in figures in pounds sterling. A common choice is the charges paid under the main agreement over 12 months, or the amount of the Processor's insurance cover.\",\n        \"options\": [],\n        \"mappings\": [\n          \"7ed3d201-1b80-433f-9537-843889985289\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Amount of the cap\\\", \\\"placeholder\\\": \\\"e.g. £100,000.00\\\", \\\"helpText\\\": \\\"Write the amount in figures in pounds sterling. A common choice is the charges paid under the main agreement over 12 months, or the amount of the Processor's insurance cover.\\\", \\\"mappings\\\": [\\\"7ed3d201-1b80-433f-9537-843889985289\\\"]}\",\n        \"visible\": true,\n        \"valid\": true,\n        \"initiallyHidden\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"6fc28271-7315-4d1b-ae97-a336a418214e\",\n    \"stepId\": \"6fc28271-7315-4d1b-ae97-a336a418214e\",\n    \"productId\": 2093,\n    \"name\": \"Data protection contacts\",\n    \"order\": 21,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"8806e29d-b4fd-439e-8f76-54146c4ca9d9\",\n        \"stepId\": \"6fc28271-7315-4d1b-ae97-a336a418214e\",\n        \"type\": \"text\",\n        \"label\": \"Data protection contact of the Controller (name and email)\",\n        \"placeholder\": \"e.g. Sarah Patel, privacy@greenfielddental.co.uk\",\n        \"helpText\": \"The person or mailbox to which the Processor sends breach notifications, requests from individuals and notices about sub-processors. A shared mailbox avoids delays during holidays.\",\n        \"options\": [],\n        \"mappings\": [\n          \"d5c2db5f-57b4-42cc-99a3-0e87b0126506\"\n        ],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"Data protection contact of the Controller (name and email)\\\", \\\"placeholder\\\": \\\"e.g. Sarah Patel, privacy@greenfielddental.co.uk\\\", \\\"helpText\\\": \\\"The person or mailbox to which the Processor sends breach notifications, requests from individuals and notices about sub-processors. A shared mailbox avoids delays during holidays.\\\", \\\"mappings\\\": [\\\"d5c2db5f-57b4-42cc-99a3-0e87b0126506\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      },\n      {\n        \"id\": \"4bd1edd7-e0bb-4a17-b3a6-63817dfb5730\",\n        \"stepId\": \"6fc28271-7315-4d1b-ae97-a336a418214e\",\n        \"type\": \"text\",\n        \"label\": \"Data protection contact of the Processor (name and email)\",\n        \"placeholder\": \"e.g. James O'Connor, dataprotection@northbridge-it.co.uk\",\n        \"helpText\": \"Its data protection officer, if it has one, or the person responsible for data protection.\",\n        \"options\": [],\n        \"mappings\": [\n          \"89fe74af-f717-4a66-a0a2-7a8d854e4aa0\"\n        ],\n        \"value\": \"\",\n        \"order\": 2,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 2,\n        \"content\": \"{\\\"label\\\": \\\"Data protection contact of the Processor (name and email)\\\", \\\"placeholder\\\": \\\"e.g. James O'Connor, dataprotection@northbridge-it.co.uk\\\", \\\"helpText\\\": \\\"Its data protection officer, if it has one, or the person responsible for data protection.\\\", \\\"mappings\\\": [\\\"89fe74af-f717-4a66-a0a2-7a8d854e4aa0\\\"]}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  },\n  {\n    \"id\": \"d9e02518-871e-42cb-909e-f6d7b878c438\",\n    \"stepId\": \"d9e02518-871e-42cb-909e-f6d7b878c438\",\n    \"productId\": 2093,\n    \"name\": \"Review and finish\",\n    \"order\": 22,\n    \"isDefault\": true,\n    \"displayCondition\": [],\n    \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n    \"updatedBy\": \"Captain.legal\",\n    \"visible\": true,\n    \"valid\": true,\n    \"fields\": [\n      {\n        \"id\": \"62ef57d8-6bf6-4c7e-a678-04453e307942\",\n        \"stepId\": \"d9e02518-871e-42cb-909e-f6d7b878c438\",\n        \"type\": \"label\",\n        \"label\": \"All the information needed has been collected. Please review the agreement on the right, then click Finish to generate the final version. Both parties sign it, and each keeps a copy with the main services contract.\",\n        \"placeholder\": \"\",\n        \"helpText\": \"\",\n        \"options\": [],\n        \"mappings\": [],\n        \"value\": \"\",\n        \"order\": 1,\n        \"createdAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"updatedAt\": \"2026-11-12T10:00:00.0000000Z\",\n        \"index\": 1,\n        \"content\": \"{\\\"label\\\": \\\"All the information needed has been collected. Please review the agreement on the right, then click Finish to generate the final version. Both parties sign it, and each keeps a copy with the main services contract.\\\", \\\"placeholder\\\": \\\"\\\", \\\"helpText\\\": \\\"\\\", \\\"mappings\\\": []}\",\n        \"visible\": true,\n        \"valid\": true\n      }\n    ]\n  }\n]\n"}