The updated data protection clauses address, in particular, the following provisions: Removing the potential for ambiguity by making the clauses more agnostic in relation to which entity is a Data Controller and/or Data Processor– thereby requiring the REC Parties to assess their own circumstances when the relevant clauses will apply; Imposing additional internal reporting obligations on parties who have suffered a personal data breach to ensure that REC Board is made aware; and Tightening definitions. REC Parties will still need to independently assess and document their respective data protection roles under the REC. The additional confidentiality obligations replicate and build upon the confidentiality obligations that already exist in condition 10 of the DCC licence. Condition 10 of the DCC licence allows DCC to use confidential information outside its Mandatory Business with Ofgem's approval. The new proposed REC Clause 18 requires – in the case of data obtained under the REC – the DCC to obtain RECCo's approval. This requirement for approval will ensure a process is place to provide, subject to the criteria set out above, a mechanism for DCC to legitimately use data obtained from the REC for any additional purposes beyond the provision of the CSR services. The proposed clause replicates the following drafting from the DCC licence – (a) the definition of Confidential Information (written by reference to the CRS Provider); (b) condition 10.12 (subject to the exceptions under condition 10.5); and condition 10.13.