12.0 THIRD PARTY PROCESSING 12.1 In fulfilment of a service to a Data Subject, the Controller may have cause to send personal data to parties (statutory or non-statutory), other than the Processor, such entities are referred to as Third Parties. 12.2 Data Controllers are required to publish a list of third parties with whom the Data Subject’s Personal Data may be shared. This publication which must also be included in the audit report should include: a) categories of third-party data recipients e.g. credit reference agencies; payment processors; insurance brokers; anti-corruption agencies etc.; b) jurisdiction of the third party; c) the purpose of the disclosure e.g. fraud checking; payment processing; dispute management; risk management; statutory requirement etc.; and d) the type of data disclosed e.g. name, phone number, address, payment details etc. 12.3 Third Party processors shall be obligated to comply with the NDPR or any other adequate data protection law existent in their country. The third-party processors are required to: a) process data only based on authorisation expressly granted by the Data Controller through a written agreement that specifies the roles and obligations of each party in respect to data protection; b) ensure there is adequate information security and process measures to protect the Personal Data being processed; rectify, grant access or delete such Personal Data on the instruction of the Data Controller (if possible) or redirect such request to the Data Controller 27 | P a g e