premise: In addition any inappropriate or unauthorised disclosure of commercially sensitive information or unlicensed reuse of intellectual property could be subject to legal action. The Agreement: This agreement relates to requirements of the Data Protection Act 1998, the Human Rights Act 1998, the ‘common law duty of confidentiality’ and the Freedom of Information Act  (2000). 1. The following terms apply where an organisation or its staff may gain access to, or have provided to it, personal identifiable information (defined within the terms of the Data Protection Act 1998) when working for, or with the ‘data controller’.  It also applies where the contracted third party is privilege to commercially sensitive information, security related information and any intellectual property of the contracting organisation. 2. The access referred to in point 1 above may include: a. Access to or sharing of information held in any electronic format or on paper b. Information that is part of verbal discussions 3. Any information (personal or organisational) will only be used for purposes agreed between the organisations.  Information will be retained for a period agreed between the parties and destroyed by an agreed method. Agreed purposes are:  To provide communication support in line with Deafness Resource Centre terms and conditions Agreed retention period: upon completion of assignment and invoicing Agreed destruction method: Shredding of paper based information and deletion of electronic information 4. Any work involving access to personal identifiable information will be done by formally authorised staff of the organisation (except as provided in paragraph 5 below).  The organisation shall keep a record of all such authorisations. Information containing a unique number (e.g. NHS, NI or organisational) or a combination of items from the following list is “personal identifiable data”: Name, Address, Postcode, Date of Birth, Other Dates (i.e. death, diagnosis), Sex, Ethnic Group or Occupation. 5. All personal identifiable information will be treated as confidential and will not be disclosed to any other persons outside the requirements of the above agreed purpose(s), without agreement of the ‘data controller’. 