Confidentiality, need-to-know, training

1.1.The Provider shall ensure that:

1.2.any persons it authorises to Process Personal Data (including employees, agents, representatives, and subcontractors) (“Authorised Persons”) are subject to a strict duty of confidentiality;

1.3.only Authorised Persons Process Personal Data on a need-to-know basis and only for the Permitted Purpose; and

1.4.Authorised Persons receive regular data protection training.