88Compliance with protective data security standards

88 Compliance with protective data security standards (1) A public sector body Head for an agency or a body to which this Part applies must ensure that the agency or body does not do an act or engage in a practice that contravenes a protective data security standard, in respect of— (a) public sector data collected, held, managed, used, disclosed or transferred by it; and (b) public sector data systems kept by it. (2) A public sector body Head for an agency or a body to which this Part applies must ensure that a contracted service provider of the agency or body does not do an act or engage in a practice that contravenes a protective data security standard in respect of public sector data collected, held, used, managed, disclosed or transferred by the contracted service provider for the agency or body. Division 4—Protective data security plans