GO

Key: C = Controller  P = Processor  Y = Yes  N= No  N/A = Not applicable

In the event that GBG processes Personal Data that is subject to the UK General Data Protection Regulation (UK GDPR) or the EU General Data Protection Regulation (GDPR) and such processing involves a Restricted Transfer to a Supplier, GBG shall ensure compliance by relying on one of the following mechanisms: (a) the use of Standard Contractual Clauses adopted by the European Commission and where UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR; (b) an adequacy decision issued by the European Commission or the UK government confirming that the recipient jurisdiction provides an adequate level of data protection; or (c) any applicable derogation under the UK GDPR or GDPR.