premise: NON-DISCLOSURE AGREEMENT
  This Non-Disclosure Agreement (“Non-Disclosure Agreement”) dated as of _____ __, 20__ (the “Effective Date”), between [_____________] (“Contractor”), a [_______________] [corporation] [limited liability company] [limited liability partnership] having offices at [_____________] and [insert legal National Grid entity] d/b/a National Grid (“National Grid”), a [____________] [corporation] [limited liability company][limited liability partnership], having offices at [_____________] (each, individually, a “Party” and, collectively, the “Parties”).
  RECITALS
  WHEREAS, the Parties and their respective Affiliates (as such term is defined below) possess certain confidential and proprietary Information (as such term is defined below); and
  WHEREAS, each Party may elect, in its sole discretion, to disclose Information to the other Party or its Representatives (as such term is defined below) in connection with [Fill In Purpose] (the “Purpose”), subject to the terms and conditions of this Non-Disclosure Agreement.
  NOW, THEREFORE, in consideration of the mutual covenants contained herein and for other good and valuable consideration, the sufficiency and receipt of which are hereby acknowledged, the Parties agree as follows:
  §1. Certain Definitions.
  (a) The term “Information” means
  (i) all financial, technical and other non-public or proprietary information which is furnished or disclosed orally, in writing, electronically or in other form or media by Disclosing Party and/or its Representatives to Recipient and/or its Representatives in connection with the Purpose and that is described or identified (at the time of disclosure) as being non-public, confidential or proprietary, or the non-public or proprietary nature of which is apparent from the context of the disclosure or the contents or nature of the information disclosed;
  (ii) all memoranda, notes, reports, files, copies, extracts, inventions, discoveries, improvements or any other thing prepared or derived from the information described in
  §1(a)(i), above;
  (iii) all CEII (as such term is defined below and only if CEII is exchanged under this Non-Disclosure Agreement);
  (iv) all Personal Information (as defined in the ISA Exhibit and only if Personal Information is exchanged under this Non-Disclosure Agreement); and
  (v) all Customer Information (as such term in is defined below and only if Customer Information is exchanged under this Non-Disclosure Agreement).
  (b) The term “Recipient” means a Party to whom the other Party or its Representatives discloses Information.
  (c) The term “Disclosing Party” means the Party disclosing Information in its possession, or on whose behalf Information is disclosed, to a Recipient.
  (d) The term “Representative(s)” means the Affiliates of a Party and the officers, directors, members, managers, employees, contractors, legal advisors, financial advisors and representatives of such Party and its Affiliates.
  (e) The term “Affiliate” means any Person controlling, controlled by, or under common control with, any other Person; “control” shall mean the ownership of, with right to vote, 50% or more of the outstanding voting securities, equity, membership interests, or equivalent, of such Person.
  (f) The term “Customer Information” includes, but is not limited to, one or more National Grid customers’ names, addresses, account numbers, billing information, load information, and usage information.
  (g) The term “Person” includes any natural person, individual, firm, corporation, company, partnership (general or limited), limited liability company, business trust, joint venture, consortium, government or political subdivision, or any agency, instrumentality, or authority of any government or political subdivision, or other entity or association.
  §2. Permitted Disclosure, Personal Information and Critical Energy/Electric Infrastructure Information.
  (a) Recipient shall receive all Information in strict confidence, shall exercise reasonable care to maintain the confidentiality and secrecy of the Information, and, except to the extent expressly permitted by this Non-Disclosure Agreement, shall not divulge Information to any third party without the prior written consent of Disclosing Party. The foregoing notwithstanding, Recipient may disclose Information to its Representatives to the extent each such Representative has a need to know such Information for the Purpose contemplated by this Non-Disclosure Agreement and agrees to observe and comply with the obligations of Recipient under this Non-Disclosure Agreement with regard to such Information. Recipient shall immediately notify Disclosing Party regarding, and shall be responsible hereunder for, any breach of the terms of this Non-Disclosure Agreement to the extent caused by its Representatives.
  (b) The Parties acknowledge that Information and/or data disclosed under this Non-Disclosure Agreement may include Personal Information (as such term is defined in the ISA Exhibit attached hereto). To the extent Personal Information is disclosed under this Non-Disclosure Agreement, the Parties obligations shall be governed by the Information Security Addendum (attached hereto as the ISA Exhibit) which is hereby incorporated by reference and explicitly made a part of this Non-Disclosure Agreement.
  (c) The Parties acknowledge that Information and/or data disclosed under this Non-Disclosure Agreement may include “Critical Energy / Electric Infrastructure Information” (“CEII”) as defined and designated by Disclosing Party, consistent with applicable Federal Energy Regulatory Commission (“FERC”) and North American Electric Reliability Corporation (“NERC”) regulations. Only if such Information contains CEII, Recipient shall, and shall cause its Representatives to, strictly comply with any and all laws, rules and regulations (including, without limitation, FERC and NERC rules, regulations, orders and policies) applicable to any such CEII that is disclosed by or on behalf of Disclosing Party or that relates to any of Disclosing Party’s or Disclosing Party’s Affiliates’ facilities. Recipient shall not divulge, and shall cause its Representatives not to divulge, any such CEII to any Person or entity, directly or indirectly, unless permitted to do so by applicable law and unless Recipient has first obtained, in each case, the express specific written consent of Disclosing Party and any affected Affiliate of Disclosing Party. In any event, to the extent that Recipient or any of its Representatives seeks or is ordered to submit any such CEII to FERC, a state regulatory agency, a court or other governmental body, whether in connection with the Purpose or otherwise, Recipient shall (and, to the extent applicable, shall cause its Representatives to), in addition to obtaining Disclosing Party’s and its Affiliate’s (as applicable) prior written consent, seek a protective order or other procedural protections to ensure that such information is accorded CEII protected status and is otherwise treated as confidential. With respect to CEII, in the event of any conflict or inconsistency between this Section and any other term or provision of this Non-Disclosure Agreement, this Section shall govern in connection with such CEII.
  (d) Recipient shall (i) identify any and all Representatives of Recipient who are authorized to receive, or have access to, CEII on the List of Representatives Authorized to Receive CEII attached hereto as the CEII Exhibit which may from time to time be amended by mutual agreement of the Parties. Each Representative named in the CEII Exhibit shall not be granted access to CEII until such individual submits to Recipient an executed Certificate of Non-Disclosure (set forth in Schedule A to the CEII Exhibit). This Section shall survive any termination, expiration or cancellation of this Non-Disclosure Agreement. The Parties shall, and shall cause their respective Representatives to, continue to comply with this Section notwithstanding expiration of the Term (as such term is defined below) or any earlier termination of this Non-Disclosure Agreement.
  §3. Exclusions from Application.
  (a) This Non-Disclosure Agreement shall not apply to Information that,
  (i) at the time of disclosure by or on behalf of Disclosing Party hereunder, is in the public domain, or thereafter enters the public domain without any breach of this Non-Disclosure Agreement by Recipient or any of its Representatives,
  (ii) is rightfully in the possession or knowledge of Recipient or its Representatives prior to its disclosure by or on behalf of Disclosing Party hereunder,
  (iii) is rightfully acquired by Recipient or its Representative(s) from a third party who is not under any obligation of confidence with respect to such Information, or
  (iv) is developed by Recipient or its Representatives independently of the Information disclosed hereunder by or on behalf of Disclosing Party (as evidenced by written documentation).
  (b) Recipient is hereby notified that, as set forth in 18 U.S.C. §1833(b), individuals do not have criminal or civil liability under U.S. trade secret law for the following disclosures of a trade secret:
  (i) disclosure in confidence to a federal, state or local government official, either directly or indirectly, or to an attorney, provided the disclosure is for the sole purpose of reporting or investigating a suspected violation of law;
  (ii) disclosure in a complaint or other document filed in a lawsuit or other proceeding if such filing is made under seal; and/or
  (iii) under those circumstances where Recipient files a lawsuit for retaliation against Disclosing Party for reporting a suspected violation of law, Recipient may disclose Disclosing Party’s trade secret information to its attorney and may use the trade secret information in the court proceeding if Recipient files any document containing the trade secret under seal and does not disclose the trade secret, except pursuant to court order.
  (c) Nothing herein or in any other agreement between the Parties is intended to conflict with 18 U.S.C. § 1833(b) or create any liability for disclosures of trade secrets that are expressly allowed by such section.
  §4. Production of Information. Recipient agrees that if it or any of its Representatives are required by law, by a court or by other governmental or regulatory authorities (including, without limitation, by oral question, interrogatory, request for information or documents, subpoena, civil or criminal investigative demand or other process) to disclose any of Disclosing Party’s Information, Recipient shall provide Disclosing Party with prompt notice of any such request or requirement, to the extent permitted to do so by applicable law, so that Disclosing Party may seek an appropriate protective order or waive compliance with the provisions of this Non-Disclosure Agreement. If, failing the entry of a protective order or the receipt of a waiver hereunder, Recipient (or any Representative of Recipient) is, in the opinion of its counsel, legally compelled to disclose such Information, Recipient may disclose, and may permit such Representative to disclose, such portion of the Information that its counsel advises must be disclosed and such disclosure shall not be deemed a breach of any term of this Non-Disclosure Agreement. In any event, Recipient shall use (and, to the extent applicable, shall cause its Representatives to use) reasonable efforts to seek confidential treatment for Information so disclosed if requested to do so by Disclosing Party, and shall not oppose any action by, and shall reasonably cooperate with, Disclosing Party to obtain an appropriate protective order or other reliable assurance that confidential treatment will be accorded the Information.
  §5. Scope of Use. Recipient and each of its Representatives shall use Information disclosed by or on behalf of Disclosing Party solely in connection with the Purpose and shall not use, directly or indirectly, any Information for any other purpose without Disclosing Party’s prior written consent.
  §6. No Representations; No Rights Conferred. Disclosing Party makes no representations or warranties, express or implied, with respect to any Information disclosed hereunder, including, without limitation, any representations or warranties as to the quality, accuracy, completeness or reliability of any such Information; all such representations and warranties are hereby expressly disclaimed. Neither Disclosing Party nor its Representatives shall have any liability whatsoever with respect to the use of, or reliance upon, the Information by Recipient or its Representatives. Neither Recipient nor its Representatives shall acquire any rights in Information by virtue of its disclosure hereunder. No license to Recipient or its Representatives, under any trademark, patent, or other intellectual property right, is either granted or implied by the disclosure of Information under this Non-Disclosure Agreement.
  §7. Return or Destruction of Information. Recipient shall return and deliver, or cause to be returned and delivered, to Disclosing Party, or destroy or cause to be destroyed (with certification of destruction delivered to Disclosing Party), all tangible Information, including copies and abstracts thereof, within thirty (30) days of a written request by Disclosing Party (a “Request”). The foregoing notwithstanding, Recipient may retain one (1) copy of such Information for archival purposes only and subject to compliance with the terms of this Non-Disclosure Agreement. Notwithstanding the foregoing, each Party agrees that Recipient shall not be required to return to Disclosing Party, or destroy, copies of Disclosing Party’s Information that (A) reside on Recipient’s or its Representatives’ backup, disaster recovery or business continuity systems, or (B) that Recipient or its Representatives are obligated by applicable law and/or governmental regulations to retain. Recipient agrees that, following its receipt of the Request, it shall neither retrieve nor use Disclosing Party’s Information for any purpose other than that specified in clause (B) above.
  - 5 -
  §8. No Partnership, Etc. Nothing contained herein shall bind, require, or otherwise commit a Party (or any Affiliate thereof) to proceed with any project, sale, acquisition, or other transaction of or with the other Party or any other entity. No agency, partnership, joint venture, or other joint relationship is created by this Non-Disclosure Agreement. Neither this Non-Disclosure Agreement nor any discussions or disclosures hereunder shall prevent either Party from conducting similar discussions with other parties or performing work, so long as such discussions or work do not result in the disclosure or use of Information in violation of the terms of this Non-Disclosure Agreement. The terms of this Non-Disclosure Agreement shall not be construed to limit either Party’s right to independently engage in any transaction, or independently develop any information, without use of the other Party’s Information.
  §9. Term and Termination. Except with respect to any Information that is Customer Information, CEII or Personal Information, Recipient’s obligations and duties under this Non-Disclosure Agreement shall have a term of [ ] [()] years from the Effective Date (the “Term”), but in no event will the confidentiality obligations herein terminate less than one (1) year from the date of the last disclosure. In the case of any Information that is Customer Information, CEII or Personal Information, Recipient’s obligations and duties under this Non-Disclosure Agreement shall survive for (i) the Term, or (ii) so long as such Customer Information, CEII or Personal Information, as applicable, is required to be kept confidential under applicable law, whichever period is longer (the “Special Information Term”). Either Party may terminate this Non-Disclosure Agreement by written notice to the other Party. Notwithstanding any such termination, all rights and obligations hereunder shall survive (i) for the Special Information Term for all Customer Information, CEII or Personal Information disclosed prior to such termination, and (ii) for the Term for all other Information disclosed prior to such termination.
  §10. Injunctive Relief. The Parties acknowledge that a breach of this Non-Disclosure Agreement by Recipient may cause irreparable harm to Disclosing Party for which money damages would be inadequate and would entitle Disclosing Party to injunctive relief and to such other remedies as may be provided by law.
  §11. Governing Law; Consent to Jurisdiction. This Non-Disclosure Agreement shall be governed and construed in accordance with the laws of the [Commonwealth of Massachusetts][State of New York][State of Rhode Island] without regard to the principles of the conflict of laws contained therein. Each Party hereby submits to the personal and subject matter jurisdiction of the courts of the [Commonwealth of Massachusetts][State of New York][State of Rhode Island] for the purpose of interpretation and enforcement of this Non-Disclosure Agreement.
  §12. Amendments. This Non-Disclosure Agreement may be amended or modified only by an instrument in writing signed by authorized representatives of all Parties.
  §13. Assignment. This Non-Disclosure Agreement may not be assigned without the express written consent of all Parties hereto; provided, however, that any Party may assign this Non-Disclosure Agreement to an Affiliate of such Party without the consent of any other Party.
  §14. Severability. Whenever possible, each provision of this Non-Disclosure Agreement shall be interpreted in such manner as to be effective and valid under applicable law, but if any provision hereof shall be prohibited by, or determined to be invalid under, applicable law, such provision shall be ineffective to the extent of such prohibition or invalidity, without invalidating the remainder of such provision or the remaining provisions of this Non-Disclosure Agreement. All obligations and rights of the Parties expressed herein shall be in addition to, and not in limitation of, those provided by applicable law.
  §15. Entire Agreement. This Non-Disclosure Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof, and any and all previous representations or agreements with respect to such subject matter, either oral or written, are hereby annulled and superseded.
  §16. Consents and Waivers. Any consent or waiver of compliance with any provision of this Non-Disclosure Agreement shall be effective only if in writing and signed by an authorized representative of the Party purported to be bound thereby, and then such consent or waiver shall be effective only in the specific instance and for the specific purpose for which it is given. No failure or delay by any Party in exercising any right, power or privilege under this Non-Disclosure Agreement shall operate as a waiver thereof, nor shall any single or partial waiver thereof preclude any other exercise of any other right, power or privilege hereunder.
  §17. No Publicity. [No Party shall issue any press release or make any other public announcement regarding the existence of this Non-Disclosure Agreement or any discussions among the Parties regarding the Purpose without the prior written consent of all Parties.]
  §18 Notices. Where written notice is required by this Non-Disclosure Agreement, such notice shall be deemed to be given when delivered personally, mailed by certified mail, postage prepaid and return receipt requested, or by facsimile or electronic mail, as follows:
  To National Grid: [_____________]
  Attn: __________________________ _______________ _______________
  To [_____________]: [_____________] Attn: __________________________ _______________ _______________
  §19 Counterparts. This Non-Disclosure Agreement may be executed in one or more counterparts, each of which will be deemed to be an original copy of this Non-Disclosure Agreement and all of which, when taken together, will be deemed to constitute one and the same agreement. The exchange of copies of this Non-Disclosure Agreement and of signature pages by facsimile or in electronic form (“.pdf” or “.tif”) shall constitute effective execution and delivery of this Non-Disclosure Agreement as to the Parties and may be used in lieu of the original Non-Disclosure Agreement for all purposes. Signatures of the Parties transmitted by facsimile or in electronic format shall be deemed to be their original signatures for all purposes. In proving this Non-Disclosure Agreement it shall not be necessary to produce or account for more than one such counterpart signed by the Party against whom enforcement is sought.
  IN WITNESS WHEREOF, this Non-Disclosure Agreement has been executed by duly authorized representatives of the Parties as of the date first above written.
  [insert legal National Grid entity] [_insert legal name of Contractor]
  By:_________________________________ By:_________________________________
  Name: Name:
  Title: Title:
  ISA Exhibit
  Information Security Addendum
  The following terms and conditions shall apply with regard to Personal Information as defined in this Information Security Addendum (“Addendum”). In the case of any inconsistency, conflict, or any other difference with respect to Personal Information between the Non-Disclosure Agreement and any of the terms in this Addendum, the terms of this Addendum shall in all cases be controlling. To the extent any capitalized terms are not defined in this Addendum, such shall have the same definition as have been provided in the preceding Non-Disclosure Agreement. The obligations of Contractor under this Addendum shall be deemed to apply to and bind Contractor’s Representative to the extent such Representative or Affiliate receives or has access to any Personal Information; provided, however, that Contractor shall remain solely liable for any noncompliance with the terms of this Addendum caused by its Representatives.
  1.0 DEFINITIONS
  1.1 “Personal Information” – means information defined as “personal information or “personal data” under applicable Law. Without limiting the foregoing, Personal Information includes information that identifies or could be used to re-identify a specific person, including but not limited to first name and last name or first initial and last name in combination with any one or more of the following data elements: addresses; residential and/or mobile telephone numbers; e-mail addresses; social security numbers; medical insurance numbers; state issued identification card number (including tribal identification numbers); driver’s license numbers or other driver identification data; personnel records; financial account information; credit related information, including any information relating to credit checks or background checks; credit or debit card numbers and personal identification numbers such as access codes, security codes or passwords that would permit access to an individual’s financial account; and medical or health information. Without limiting the foregoing, Personal Information includes all private data of National Grid and its affiliates’ employees, officers, directors, subcontractors, agents, and customers, that Contractor receives from National Grid, and as may be defined by applicable state and/or federal statutes and regulations. Personal Information shall not include publicly available information, lawfully made available to the general public in federal, state, or local government records.
  1.2 “Law” – means, with respect to this Addendum, any foreign, federal, state or local law or regulation, promulgated or amended from time to time during the term of this Non-Disclosure Agreement, applicable to Personal Information received by Contractor from National Grid, including, but not limited to, the Protection of Personal Information of Residents of the Commonwealth of Massachusetts, 201 CMR 17.00 (the “MA Security Regs”), the Rhode Island Identity Theft Protection Act, RIGL § 11-49.3-1 (the “RI Security Regs”) and the California data security regulations, Cal. Civ. Code § 1798.81.5, (the “CA Security Regs”).
  2.0 SECURITY
  2.1 Contractor hereby agrees to comply with all Laws it receives from National Grid during the term of the Non-Disclosure Agreement and ensure that all subcontractors or vendors who have access to National Grid’s Personal Information comply with all Laws.
  2.2 Contractor agrees to, and agrees to ensure that its subcontractors and/or vendors who have access to National Grid’s Personal Information will, implement and maintain appropriate physical, technical and administrative security measures for the protection of Personal Information as required by any Law or as required by National Grid; including, but not limited to: (i) encrypting all transmitted records and files containing Personal Information that will travel across public networks, and encryption of all data containing Personal Information to be transmitted wirelessly; (ii) prohibiting the transfer of Personal Information to any portable device unless such transfer has been approved in advance; (iii) retaining Personal Information for a period no longer than is reasonably required to provide the services requested, to meet the purpose for which it was collected, or in accordance with a written retention policy or as may be required by Law; and (iv) encrypting any Personal Information to be transferred to a portable device.
  2.3 Contractor shall develop, document and implement quality assurance measures and internal controls, including implementing tools and methodologies, so that the Services outlined in the any agreements between the Parties are performed in an accurate and timely manner, in accordance with such agreement and applicable Law.
  2.4 Contractor shall: (i) maintain a strong control environment in day-to-day operations; (ii) document the processes and procedures for quality assurance and internal controls; (iii) develop and execute a process to ensure regular internal control self-assessments are performed with respect to the Services; and (iv) maintain an internal audit function sufficient to monitor the processes and systems used to provide the Services.
  2.5 Contractor shall not, directly or indirectly, divulge, disclose or communicate any Personal Information it receives from National Grid to any Person, firm, or corporation, except with the written permission of National Grid.
  2.6 All records pertaining to Personal Information received from National Grid, whether developed by National Grid or others, are and shall remain the property of National Grid.
  2.7 In addition to the above requirements, Contractor shall adopt, implement and maintain security procedures sufficient to protect Personal Information from improper access, disclosure, use, or premature destruction. Such security procedures shall be reasonably acceptable to National Grid and in compliance with all applicable Laws as they are promulgated or amended. Contractor shall maintain or adopt a written information security program (“WISP”) or its equivalent consistent with the MA Security Regs and the RI Security Regs, and any other applicable Laws that govern the protection of Personal Information received from National Grid or maintained on behalf of National Grid. Contractor agrees to apply the standards and requirements of the MA Security Regs and RI Security Regs to all such Personal Information, regardless of the jurisdiction in which the subject of Personal Information resides. During the term of the Non-Disclosure Agreement and for a period of seven (7) years thereafter, Contractor shall maintain, and provide for National Grid’s review, at National Grid’s request, (a) Contractor’s WISP; and (b) other applicable security program documents, including summaries of its incident response policies, encryption standards and/or other computer security protection policies or procedures, that constitute compliance with applicable Laws. Contractor shall provide National Grid with notice of any amendments to its WISP and such policies or programs, and any new policies or programs related to information privacy and security as may be adopted by Contractor from time to time, within thirty (30) days after the adoption of any such amendment, policy or program or changes in applicable Law.
  2.8 Contractor agrees to notify National Grid promptly, but in no event later than 24 hours, after discovery of a security vulnerability, including, but not limited to, an exploitation of security vulnerabilities by third parties that have resulted in corruption, unauthorized modification, sale, rental, and/or otherwise damages to or materially alters the integrity of National Grid’s Information, and shall work with National Grid to mitigate such vulnerabilities.
  2.9 Contractor shall have a process for managing both minor and major security incidents. Contractor shall notify National Grid promptly, and in no event later than five (5) days after discovery, in writing, of any unauthorized access, possession, use, destruction or disclosure of Personal Information (a “Security Breach”). Contractor shall promptly and in writing provide National Grid with full details of the Security Breach, and shall use reasonable efforts to mitigate such Security Breach and prevent a recurrence thereof. Security Breaches include, but are not limited to, a virus or worm outbreak, cyber security intrusions into systems directly responsible for supporting National Grid data and services, physical security breaches into facilities directly responsible for supporting National Grid data and services, and other directed attacks on systems directly responsible for supporting National Grid data and services. Contractor shall not be required to provide a written report of attempted security incidents. “Attempted Security Incidents” means, without limitation, pings and other broadcast attacks on firewall, port scans, unsuccessful log-on attempts, common denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of Personal Information or other serious vulnerability to National Grid’s data. In the event of a Security Breach, the parties shall cooperate to (a) mitigate and resolve any data privacy or security issues involving Personal Information, and (b) make any notifications to individuals affected by the Security Breach, and/or governmental/administrative entities as required by Law. Contractor’s failure to comply with this Article 2.9 shall be considered a material breach of the Non-Disclosure Agreement, for which no cure period shall apply.
  2.10 Following a Security Breach, National Grid, or its designated agent, shall have the right, upon reasonable notice to Contractor, to complete a review of Contractor’s security measures and ensure that unauthorized access to Personal Information has been eliminated.
  2.11 Contractor agrees to ensure that any subcontractor or vendor to which it provides National Grid’s Information, including Personal Information received from National Grid, or to which it provides National Grid’s Information and/or Personal Information created or received by Contractor on behalf of National Grid, agrees to the same restrictions and conditions set forth herein through a written contractual agreement.
  2.12 Contractor agrees that National Grid’s data, including Personal Information, may not be maintained, stored, or transmitted outside of the United States of America, except for entities that are legally affiliated with Contractor or are wholly owned subsidiaries of Contractor.
  2.13 Contractor agrees that it shall be responsible for any and all acts of any subcontractors or vendors to which it allows access to National Grid Information and/or Personal Information.
  2.14 Contractor shall provide National Grid with a list of all subcontractors and vendors that will have access to National Grid’s Confidential and/or Personal Information.
  2.15 Contractor understands the extremely sensitive nature of the Information, including Personal Information it receives from National Grid, and acknowledges that National Grid would suffer irreparable harm, for which damages would not be an adequate remedy, if National Grid’s Personal Information were improperly disclosed. Contractor therefore agrees that National Grid shall be entitled to seek and obtain equitable relief in addition to all other remedies at law to protect its Personal Information.
  2.16 Contractor agrees that, to the fullest extent permitted by law, it shall be and remain strictly liable for the security of all Personal Information when in Contractor’s possession and when being transmitted from Contractor or received by Contractor. Without limiting any other obligations under any agreement entered into between the Parties, Contractor agrees that it shall defend, indemnify and hold harmless National Grid and its Affiliates and their officers, directors, employees, agents, servants, successors and assigns, from and against any and all claims, losses, demands, liabilities, costs and other expenses (including but not limited to, reasonable attorneys’ fees and costs, administrative penalties and fines, costs expended to notify individuals and/or to prevent or remedy possible identity theft, financial harm or any other claims of harm related to a breach) incurred as a result of, or arising directly out of or in connection with any acts or omissions of Contractor or any party under its control, including, but not limited to, negligent or intentional acts or omissions, resulting from a Security Breach or encryption failure in the transmission of such Personal Information, except to the extent such act or omission is caused by the sole negligence of National Grid. This provision shall survive termination of this Addendum, the Non-Disclosure Agreement and any other agreement between the Parties relevant to the Purpose.
  2.17 Contractor shall maintain or cause to be maintained sufficient insurance coverage as shall be necessary to insure Contractor and its employees, agents, Representatives and subcontractors against any and all claims or claims for damages arising under this Addendum and the Non-Disclosure Agreement and such insurance coverage shall apply to all services provided by Contractor or its Representatives, agents or subcontractors.
  2.18 When required by law, by a court or by other governmental or regulatory authorities (including, without limitation, an employment tribunal), Contractor shall provide, and formally document, a method that ensures that it can secure, preserve, and transfer digital evidence and artifacts to National Grid in a format that shall comply with such law or be admissible by such court or authority. Deviations from the documented method, either ad-hoc or permanent (e.g. due to new case law or technological advancements), must be agreed upon by the Parties in advance and must still adhere to the aforementioned format and documentation requirements.
  2.19 In the event that Contractor fails to fulfill the above obligations or in the event that such failure appears to be an imminent possibility, National Grid shall be entitled to all legal and equitable remedies afforded it by law as a result thereof and may, in addition to any and all other forms of relief, recover from the undersigned all reasonable costs and attorneys’ fees encountered by it in seeking any such remedy.
  3.0 DATA SCRUBBING VERIFICATION
  3.1 Upon termination of all agreements between the Parties relevant to and in connection with the Purpose, Contractor shall return to National Grid all Personal Information or destroy such Personal Information beyond recovery and certify such destruction in writing to National Grid. Without limiting the foregoing, upon termination of all agreements between the Parties relevant to and in connection with the Purpose, Contractor shall use the best possible means to scrub, or otherwise destroy beyond recovery all electronic Personal Information in its possession, certifying such destruction in writing to National Grid’s procurement agent, and providing National Grid with a written explanation of the method used for data disposal/destruction, along with a written certification that such method meets or exceeds the National Grid’s data handling standards and industry best practices for the disposal/destruction of sensitive data. If such return or destruction is not feasible, Contractor shall provide to National Grid notification of the conditions that make return or destruction infeasible. Upon National Grid’s written agreement that return or destruction of Personal Information is infeasible, Contractor shall extend the protections of this Addendum to such Personal Information and limit further uses and disclosures of such Personal Information to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such Personal Information.
  4.0 AUDIT
  4.1 Contractor shall, from time to time during the term of the Non-Disclosure Agreement and for a period of seven (7) years thereafter, during regular business hours and upon reasonable notice, permit National Grid or its representatives to perform audits of Contractor’s facilities, equipment, books and records (electronic or otherwise), operational systems and such other audits as may be necessary to ensure: (a) Contractor’s compliance with this Addendum, (b) Contractor’s compliance with all applicable Law, and (c) Contractor’s financial and operational viability, including but not limited to Contractor’s internal controls, security policies, business resumption, continuity, recovery, and contingency plans.
  4.2 National Grid requires an annual written self-certification from Contractor based on an independent third party audit that scrutinizes and confirms the effectiveness of controls. If Contractor fails to perform its audit obligations hereunder, National Grid (or an independent third party auditor on its behalf that is subject to confidentiality obligations) may audit Contractor and subservice providers control environments and security practices relevant to services provided once in any twelve (12)-month period, with reasonable prior written notice (at least seven (7) days’ notice) and under reasonable time, place and manner conditions.
  4.3 In addition to the above, National Grid may also request Contractor to participate in an audit and information disclosure in the event (a) National Grid receives any audit requests from a governmental or regulated agency, and/or (b) within 24 hours if Contractor suffers a Security Breach.
  5.0 MISCELLANEOUS
  5.1 Where applicable, if, and only with National Grid’s prior consent, Contractor processes Personal Information received from National Grid from the “European Economic Area” or “EEA” (as defined below) in a jurisdiction that is not an approved jurisdiction under the EEA, Contractor shall ensure that it has a legally approved mechanism in place to allow for the international data transfer prior to the transfer of any such Personal Information and Contractor will abide by the obligations under Regulation (EU) 2016/679, the General Data Protection Regulation, fair and lawful use requirements, together with any additional implementing legislation, rules or regulations that are issued by applicable supervisory authorities with respect to such Personal Information. The “EEA” means those countries that are members of European Free Trade Association (EFTA), and the then-current, post-accession member states of the European Union.
  5.2 Contractor agrees to cooperate fully with National Grid and to execute such further instruments, documents and agreements, and to give such further written assurances as may be reasonably requested by the other Party, to better evidence and reflect the transactions described in and contemplated by this Addendum, and to carry into effect the intents and purposes of this Addendum.
  5.3 The terms of this Addendum shall survive the termination of all agreements between the Parties related to or in connection with the Purpose for any reason.
  CEII Exhibit
  List of Contractor Representatives Authorized to Receive CEII
  Schedule A
  CERTIFICATE OF NON-DISCLOSURE
  I, the undersigned, hereby certify my understanding that the Information which includes critical energy/electric infrastructure information (“CEII”) is being provided to me pursuant to the terms and restrictions of the Non-Disclosure Agreement by and between National Grid and ____________ dated _________, ___ 20__ (“Non-Disclosure Agreement”). I also certify that I have been given a copy of that Non-Disclosure Agreement, have read its terms and conditions, and agree to be bound by, and comply with, such terms of conditions. I understand that the contents of the Information and any notes, memoranda, computer software, software documentation or any other forms of information regarding or derived from the Information shall not be disclosed to anyone other than in accordance with the Non-Disclosure Agreement and shall be used only for the Purpose as defined in the Non-Disclosure Agreement. I further certify that I will retain an executed copy of this executed Schedule A for seven (7) years from the expiration of the Non-Disclosure Agreement and will forward a signed copy of the same to my National Grid contact.
  I further acknowledge and agree that, in the event that I cease to be engaged in the Purpose, I shall continue to be bound by the terms and conditions of this Non-Disclosure Agreement.
  Signature: ______________________________
  Print Name: _____________________________
  