premise: 1. The following terms apply where an organisation or its staff may gain access to, or have provided to it, personal identifiable information (defined within the terms of the Data Protection Act 1998) when working for, or with the ‘data controller’.  It also applies where the contracted third party is privilege to commercially sensitive information, security related information and any intellectual property of the contracting organisation. 2. The access referred to in point 1 above may include: a. Access to or sharing of information held in any electronic format or on paper b. Information that is part of verbal discussions