1.1.1 This Data Integration Platform Supplement ("DIP Supplement") is part of the Balancing and Settlement Code (BSC) with effect from the Implementation Date.

1.1.2 The background to this DIP Supplement is as follows:

(a) on 14 December 2021, the Authority published a decision that there should be an event driven architecture (subsequently named as the Data Integration Platform (DIP)) established to facilitate the implementation and operation of Market-wide Half Hourly Settlement ;

(b) on 6 April 2022, the Authority issued a Significant Code Review direction to BSCCo setting out a proposed Modification and the timetable for the BSC Panel to progress a Modification (P439) enabling Elexon, in its capacity as the implementation manager, to develop the systems and processes that may be necessary to implement the Data Integration Platform. That Modification was subsequently approved by the Authority on 25 May 2022;

(d) this Supplement sets out the terms on which the DIP shall be governed.

1.2 General

1.2.1 This DIP Supplement sets out:

(a) the governance arrangements relating to the DIP;

(b) the functions, duties and powers of BSCCo in its capacity as DIP Manager;

(d) the obligations on Parties as DIP Users; and

(e) the arrangements relating to the DIP Users who are not BSC Parties.

1.2.2 In respect of the DIP Rules:

(a) the functions of, and the things done by, the DIP Manager and the DCAB under and pursuant to the DIP Rules shall be considered to be functions under and things done pursuant to the BSC, provided that (unless explicitly provided for in the DIP Rules) the BSC Panel (including, for the avoidance of doubt, each Committee) shall have no duties or responsibilities in relation to the DIP Rules and BSCCo shall owe no duties to the BSC Panel or BSC Parties in the carrying out of such functions except where the BSC may specifically state otherwise; and

(b) save as set out in the DIP Rules, and subject to paragraph 1.2.3, the provisions of the BSC shall not apply to the DIP Rules.

1.2.3 Notwithstanding paragraph 1.2.2, any change to:

(a) the DIP Supplement; or

(b) any provisions of the BSC that form part of the DIP Rules;

shall be subject to the Modification Procedures.

1.2.4 For the purposes of this DIP Supplement, the terms set out in the Glossary in DSD007 ‘DIP Glossary’ shall have the meanings set out in the Glossary.

1.3 DIP Applicable Objectives

1.3.1 The DIP Applicable Objectives shall be to:

(a) provide accurate and timely support for the sharing of applicable market data;

(b) further consumer interests through the appropriately governed sharing of data; and

(c) facilitate competitive change and innovation through the efficient and economic delivery of reliable and adaptable services.

1.4 Categories of DIP Users

1.4.1 Details of the categories of DIP User are set out in DSD002 ‘DIP Connection Requirements’, which include BSC Parties acting in the following capacities:

(a) Supplier;

(b) Unmetered Supplies Operator (UMSO);

(d) BSCCo.

1.4.2 Other organisations, as specified in DSD002, which are not BSC Parties are able to become DIP Users by entering into an Access Agreement, as further set out in DSD002. The Access Agreement may not grant rights to, or impose obligations on, such other organisations beyond the rights and obligations of DIP Users generally.

1.4.3 Each DIP User hereby authorises and instructs the DIP Manager to execute each Access Agreement on that DIP User’s behalf. Each DIP User undertakes not to withdraw, qualify or revoke any such authority or instruction at any time.

1.5 DIP Documents

1.5.1 DIP Rules shall have binding effect. Each DIP User shall comply with each of the DIP Rules and especially the DIP Subsidiary Documents (DSDs) in force from time to time (whether or not any DSD is expressly identified or referred to in the DIP Supplement) to the extent such DSD is applicable to such DIP User.

1.5.2 The DIP Supplement refers to and creates obligations in respect of DSDs.

1.5.3 A reference in the DIP Supplement or in any DSD to a DSD shall be to the version of that DSD then in force, unless the context otherwise requires.

1.5.4 References in the BSC to the DIP Supplement shall be interpreted to include all relevant DSDs, unless the context otherwise requires.

1.5.5 Where a DIP User is also Party to an Industry Code, a breach of the DIP Supplement and any DSD shall be treated as a breach of the relevant Industry Code.

1.5.6 Each DSD should be read in conjunction with the DIP Supplement and the BSC. In the event of an inconsistency between the provisions of a DSD and the DIP Supplement, the provisions of the DIP Supplement shall prevail. In the event of any inconsistency between the DIP Supplement and the BSC in relation to:

(a) the matters set out in a DSD only, then the DIP Supplement shall prevail;

(b) any matters which the DIP Supplement expressly provides for or where the DIP Supplement is expressed to take precedence over the BSC, then the DIP Supplement shall prevail; and

1.6 DIP Guidance Documents

1.6.1 The DIP Manager shall maintain and publish such guidance documents as it considers necessary in order to provide information and assistance to DIP Users with regards to the DIP Rules.

1.6.2 DIP Guidance Documents may not place obligations on DIP Users or the DIP Manager. Accordingly, DIP Users and the DIP Manager should take note of the DIP Guidance Documents, but DIP Users and the DIP Manager are not obliged by the DIP Rules to comply with the DIP Guidance Documents.

1.7 Interpretation

1.7.1 In the DIP Rules:

(a) use of the singular includes the plural and vice versa;

(b) a person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality);

(d) a reference to a statute or statutory provision is a reference to it as amended or re-enacted. A reference to a statute or statutory provision includes all subordinate legislation made under that statute or statutory provision;

(e) any words following the terms “including”, “include”, “in particular”, “for example” or any similar expression shall be construed as non-exhaustive;

(f) a reference to writing or written includes email; and

(g) for the purpose of any consultation within this DIP Supplement, when the DIP Manager is considering responses each response shall have equal value based on strength of argument, supported by evidence where possible.

1.8 Appeals generally in the DIP

1.8.1 Appeals against a decision of the DIP Manager as to:

(a) whether to permit DIP On-Boarding;

(b) whether to carry-out DIP Off-Boarding;

(d) whether to permit DIP Data publication and/or sharing;

which cannot be resolved by discussion, shall be made to the DCAB in such form and format as the DCAB Secretary may reasonably require and in accordance with the procedures and time limits set out in the DSDs.

1.8.2 If DCAB decides that an appeal is vexatious, frivolous or has no reasonable prospect of success it shall give notice of such finding and dismiss the appeal.

1.8.3 Appeals against any decision of the DCAB, which cannot be resolved by discussion, shall be to the Authority. The DIP Manager shall publish a procedure and process online setting out requirements for appeals to the Authority (having first consulted with the Authority).

1.8.4 Where there is to be an appeal against a decision of the DCAB to the Authority, such appeal shall be made to the Authority, within such period as may be prescribed by the DSDs or the Authority’s own procedures, of the appellant’s written notification of the DCAB decision. Any decision by the Authority in respect of such an appeal shall be final and binding for the purposes of the DIP Rules. The Authority may determine such matter or appeal in such manner and using such procedures as it considers fit.

1.9 General provisions

1.9.1 Each of the Code provisions referred to in paragraph 1.9.2 shall apply to the DIP Rules with all the necessary changes having been made (that is, mutatis mutandis), so that:

(a) references to BSCCo are references to the DIP Manager;

(b) references to the Panel are references to the DCAB (to the extent relevant);

(d) references to Code Subsidiary Documents are references to DSDs; and

(e) references to the BSC are references to the DIP Rules.

1.9.2 The provisions referred to in paragraph 1.9.1 are:

(a) Section C5.1 and C5.2 regarding the liability of the DIP Manager to DIP Users;

(b) Section C5.3 regarding the capacity of the DIP Manager;

(d) Section H7 regarding the resolution of disputes that arise under, or relate to, the DIP Rules;

(e) Section H9.1 regarding transfers to rights or obligations under the DIP Rules (and where any transfer under Sections A2.7 or Section A5.1.6 of the BSC shall also constitute a transfer of rights and obligations under the DIP Rules, but subject always to the provisions of DSD002 ‘DIP Connection and Operation);

(f) Section H9.3 regarding waiver;

(g) Sections H9.4.1 to 9.4.3 regarding third party rights (provided that, notwithstanding the wording of Section H9.4.1 to 9.4.3 and the intention that the Contracts (Rights of Third Parties) Act 1999 should not apply to any provision of the Code, the Parties agree that the Access Agreement may contain provisions that give Non-Party DIP Users the same rights, benefits, entitlements and privileges under the DIP Rules as DIP Users who are BSC Parties; and

(h) Sections H9.5 to 9.10 regarding general governance.

1.10 Force Majeure

1.10.1 If any DIP Participant (referred to as the affected participant) shall be unable to carry out any of its obligations under the DIP Rules due to a circumstance of Force Majeure, then the DIP Rules shall remain in effect but:

(a) the affected participant’s obligations; and

(b) any other obligations of the other DIP Participants which a DIP Participant is unable to carry out directly as a result of the suspension of the affected participant’s obligations;

shall be suspended without liability for the period during which the circumstance of Force Majeure prevails (subject to paragraph 1.10.2).

1.10.2. Relief under Clause 1.10.1 is subject to the following:

(a) the affected participant shall give the DIP Manager prompt notice, confirmed in writing as soon as reasonably practicable and in any event no later than 48 hours, describing the circumstance of Force Majeure including the nature of the occurrence and its expected duration and where reasonably practicable, shall continue to furnish regular reports with respect thereto during the period of Force Majeure;

(b) the suspension of performance shall be of no greater scope and of no longer duration than is required by the circumstance of Force Majeure;

(c) the obligations of any DIP Participant that arose before the circumstance of Force Majeure causing the suspension of performance shall not be excused as a result of the Force Majeure;

(d) the affected participant shall take all reasonable steps to mitigate the impact of the circumstance of Force Majeure and to remedy its inability to perform as quickly as possible; and

(e) immediately after the end of the circumstance of Force Majeure, the affected DIP Participant shall notify the DIP Manager in writing of the same and resume performance of its obligations under the DIP Rules.

1.10.3 Nothing in this paragraph 1.10 shall apply to the obligations of affected participants or DIP Participants under Industry Codes and any relief of such persons under those Industry Codes shall be subject to the rules therein.

1.11 Notices

1.11.1 Where the DIP Rules require or envisage any communications to be contained in Messages, or where these DIP Rules otherwise require communications to be sent by specified means (whether or not via the DIP), then Messages and communications shall be sent via those specified means.

1.11.2 Subject to paragraph 1.11.1, any notice or other communication to be made by one DIP Participant to another DIP Participant under or in connection with the DIP Rules shall be in writing and shall be sent by email.

1.11.3 All notices and communications, as described in paragraph 1.11.2, shall be sent to the email address specified for such purpose in the relevant DIP Participant’s On-Boarding information (as amended from time to time by the DIP Participant).

1.11.4 Subject to paragraph 1.11.5, all notices and communications, as described in paragraph 1.11.2, shall be deemed to be received by the recipient if sent by email, one hour after being sent, unless an error message is received by the sender in respect of that email before that hour has elapsed.

1.11.5 Any notice that would otherwise be deemed to be received on a day that is not a Working Day, or after 17.30 hours on a Working Day, shall be deemed to have been received at 9.00 hours on the next following Working Day.

1.11.6 Notices or other communications under or in connection with the DIP Rules from or to the DCAB, DCAB sub-group or DIP Manager shall also be subject to this paragraph 1.11. Where such notices or other communications are being sent to the DCAB, DCAB sub-group or DIP Manager, they shall be sent to the relevant address published from time to time by the DIP Manager.

2. GOVERNANCE

2.1 Authority of DIP Manager

2.1.1 The DIP Manager is empowered and authorised to make determinations as set out in the DIP Rules.

2.2 Composition and Responsibilities of DCAB

2.2.1 The DCAB shall be composed of the following DCAB Members, full details of which are set out in DSD001 ‘DIP Governance’:

(a) DCAB Chair – nominated and only entitled to exercise a casting vote in accordance with DSD001;

(b) DCAB Secretary – nominated and non-voting;

(d) two Data Services constituency members – elected and voting;

(e) two Meter Services constituency members – elected and voting

(f) two Distributor constituency members – elected and voting;

(g) two independent electricity industry members – elected and voting;

(h) one consumer member – nominated and voting;

(i) one Code Body member per relevant Code Body – nominated and voting;

(j) one DIP Manager member – nominated and non-voting;

(k) one representative from the organisation holding the Licence which gives rise to the DIP Rules, subject to DSD001 – nominated and non-voting; and

(l) one Authority member – nominated and non-voting.

2.2.2 The DCAB shall be responsible for:

(a) approving Tier One DIP CRs;

(b) advising the DIP Manager as required;

(d) agreeing the scope of the DIP Manager Audit.

2.2.3 DIP Manager shall indemnify and keep indemnified:

(a) each DCAB Member and Alternates;

(b) the DCAB Chair;

(d) each DIP Participant or party as employer of any person referred to in (a) to (c) of this paragraph

from and against any and all costs(including legal costs), charges, expenses, damages or other liabilities incurred or suffered by that person or employer in relation to the exercise of that person’s powers, duties or responsibilities under the DIP including where such powers, duties or responsibilities are exercised negligently, but subject to the following paragraph 2.2.4.

2.2.4 The indemnity in paragraph 2.2.3 shall not apply to:

(a) costs, charges, expenses, damages or other liabilities suffered or incurred or occasioned by the wilful default, misconduct or fraud of the relevant person or in breach of a contract entered into by the relevant person with the DIP Manager; and/or

(b) costs, charges, expenses, damages or other liabilities which are recovered under any policy of insurance in favour of the DIP Manager.

2.3 Election and term

2.3.1 Elections to the DCAB shall be organised by the DCAB Secretary and timing and processes are set out in more detail in DSD001 ‘DIP Governance’.

2.3.2 As regards voting for constituency DCAB Members, only a single entity within a Corporate Group may exercise a vote on behalf of all DIP Users within that Corporate Group. DSD001 shall contain rules for determining which entity within a Corporate Group may exercise that vote.

2.4. Meetings

2.4.1 All meetings shall be held in public and shall be open to anyone to attend, except to the extent that the DCAB Chair decides otherwise on the basis of confidentiality (including data and business secrecy issues).

2.5. DIP Manager Role

2.5.1 The DIP Manager shall provide:

(a) the DCAB Chair who shall be an employee of DIP Manager who has been approved in writing by the Authority from time to time;

(b) the DCAB Secretary who shall perform all the secretariat functions necessary for DCAB; and

2.5.2 No one person may be appointed to more than one of the roles provided by DIP Manager in 2.5.1 at any time. In addition no person may fulfil one of those roles and also represent any relevant Code Body on DCAB.

2.6. Quorum and Voting

2.6.1 The quorum for any meeting shall be 7 DCAB Members able to vote, always excluding the DCAB Chair (and any DCAB Member who has been excluded from the meeting by the DCAB Chair under DSD001‘DIP Governance’).

2.6.2 Voting at meetings of the DCAB shall be in accordance with DSD001.

2.6.3 DCAB Members may appoint an Alternate in their place for a meeting provided that the member advises the DCAB Chair and DCAB Secretary in accordance with DSD001.

2.6.4 An Alternate so appointed may act as if they were the DCAB Member for all purposes for the DCAB meeting for which they have been appointed.

2.7. Timing and Documents

2.7.1 The administration of DCAB meetings shall be determined in accordance with DSD001‘DIP Governance’.

2.8. DCAB Decisions

2.8.1 Provided that a meeting is quorate, decisions of the DCAB shall be by simple majority of those attending the meeting and entitled to vote.

2.8.2 If the vote is tied, then the DCAB Chair shall have the deciding vote. The DCAB Chair may decide to postpone any decision for further discussion and future decision.

2.9. Proceedings

2.9.1 The DCAB shall determine its governance and procedures as it sees fit, subject to the express requirements of the DIP Rules.

2.9.2 The DCAB Chair may exclude a DCAB Member from part or all of a DCAB meeting where the DCAB Chair considers that:

(a) the matters under discussion present a conflict of interest for the DCAB Member (in which case the DCAB Chair may exclude the DCAB Member from that part of the discussion where the conflict of interest may arise);

(b) the DCAB Member is acting in a way that is disruptive to the efficient running of the DCAB or which is damaging to the reputation of the DIP or the DCAB (in which case paragraph 2.9.3 shall apply); and/or

(c) the DCAB Member is failing to attend sufficient, as described in DSD001 ‘DIP Governance’, DCAB meetings (in which case paragraph 2.9.3 shall apply).

2.9.3 Where 2.9.2(b) or (c) applies, the DCAB Chair shall have the powers, and be subject to the restrictions, set out in DSD001, regarding:

(a) the temporary or permanent exclusion of DCAB Members; and

(b) the temporary or permanent replacement of DCAB Members who have been excluded.

2.9.4 A DCAB Member shall automatically be removed from office if:

(a) the DCAB Member dies or resigns their office;

(b) the DCAB Member becomes prohibited by law from being a director of a company under the Companies Act 2006;

(d) a composition is made with that person’s creditors generally in satisfaction of that person’s debts; or

(e) a registered medical practitioner, who is treating that person, gives a written opinion to the DCAB Chair stating that that person has become physically or mentally incapable of acting as a DCAB Member and may remain so for more than three months.

2.9.5 The DCAB may establish such sub-groups as it considers desirable. However, such sub-groups may only be established to assist the DCAB (whether for a particular matter or on a standing basis). The advice and guidance of any sub-group shall be advisory only and shall not be binding on the DCAB.

2.9.6 Subject to 2.9.5, sub-groups shall be subject to the written terms of reference and procedures determined by the DCAB (as long as those terms of reference do not conflict with any requirements of the DIP Rules).

2.9.7 DSD001 may include provisions allowing determinations of the DCAB to be made by written resolution.

3. DIP CONNECTION AND OPERATION

3.1 DIP On-Boarding

3.1.1 This chapter of the DIP Supplement sets out the criteria that must be met by DIP Applicants. The process, as detailed in DSD002 ‘DIP Connection and Operation’ is designed to provide assurance that a DIP Applicant’s systems and processes will enable them to comply with this DIP Supplement and interface with other DIP Users. These processes are not intended to place additional requirements on DIP Users over and above those needed to meet this purpose.

3.1.2 In respect of a DIP Role, a DIP User (including a Non-Party DIP User) must have successfully completed DIP On-Boarding for that DIP Role before it may use the DIP Services in the capacity of that DIP Role.

3.1.3 In respect of Non-Party DIP Users, an Access Agreement will specify the terms and conditions applicable to each relevant DIP Role, to ensure that the Non-Party DIP User is bound to comply with the DIP Supplement. A DIP Applicant that intends to be a Non-Party DIP User shall not be entitled to pass the initial approval process pursuant to DSD002 until they have entered into an Access Agreement.

3.1.4 The scope of DIP On-Boarding will vary depending on the DIP Roles applied for. All DIP Applicants will be required to agree to any terms and/or agreements required by the DIP Service Provider and/or DIP Verification Service Provider as a provision of DIP On-Boarding. Such terms and/or agreements shall form part of the DIP Rules. Compliance with them shall be deemed part of the DIP User’s obligations under the DIP Rules.

3.1.5 The DIP Manager and, where applicable the DCAB, shall manage DIP On-Boarding without undue discrimination.

3.1.6 The DIP Manager shall be responsible for DIP On-Boarding and shall determine, subject to paragraph 3.1.7(c), whether to approve DIP On-Boarding of a DIP Applicant, in each case in accordance with DSD002.

3.1.7 Where a DIP Applicant disagrees with a decision of the DIP Manager not to approve their DIP On-Boarding under paragraph 3.1.6:

(a) the DIP Applicant may refer the matter to the DCAB for determination; and

(b) the DCAB shall adopt such procedures as it sees fit (and in adopting such procedures it shall have regard to the requirements of DSD002) for the purposes of determining whether to approve the DIP Applicant’s DIP On-Boarding.

3.2 DIP Off-Boarding

3.2.1 This paragraph sets out the process with which the DIP Manager and a DIP User must comply to discontinue that DIP User’s access to the DIP.

3.2.2 This includes:

(a) Revocation of a DIP User’s access to some or all of the DIP Services;

(b) Suspension of a DIP User’s access to some or all of the DIP Services; and

Revocation

3.2.3 The DIP Manager may, in accordance with this DIP Supplement and DSD002 ‘DIP Connection and Operation’, Revoke a DIP User’s access to the DIP Service where:

(a) that DIP User is subject to an ongoing Event of Default;

(b) the DIP User:

(i) is a party to an Industry Code that requires them to access DIP Services and that DIP User has been expelled or has otherwise ceased to be a party to that Industry Code;

(ii) held a Licence that has been revoked by the Authority;

(iii) has had its MPANs transferred to another Supplier pursuant to the Supplier of Last Resort process, the Trade Sale process or pursuant to the Energy Supply Company Administration regime;

(d) the DIP User is in breach of the DIP Rules that has caused a Security Breach, including in relation to the DIP User’s own systems, that impact the DIP, the DIP and/or Digital Certificates; and/or

(e) the DIP Manager is entitled to Suspend a DIP User’s access under paragraph 3.2.5 and considers that the severity and impact of the circumstances giving rise to the right to Suspend are such that the DIP User’s access should be revoked,

in which case the DIP Manager shall co-ordinate any proposed Revocation of access with any concurrent process under the other Industry Codes and/or any action by the Authority.

3.2.4 DIP Users acknowledge and agree that DSD002 may contain further Revocation events provided that such events do not impose Revocation events that differ materially in scope or nature from the events described in paragraph 3.2.3.

Suspension

3.2.5 The DIP Manager may, in accordance with this DIP Supplement and DSD002, Suspend a DIP User’s access to DIP Services without notice where:

(a) the DIP User is in breach of the Fair Use Requirements;

(b) the DIP Manager reasonably believes that the Suspension is necessary as a result of an emergency business continuity event; or

(c) the DIP User is subject to an ongoing Revocation event pursuant to paragraph 3.2.3 and where it has been determined by the DIP Manager (either in conjunction with the Authority and/or Code Bodies, or determined independently) that the severity and impact of such event does not yet warrant action under paragraph 3.2.3.

3.2.6 DIP Users acknowledge and agree that DSD002 may contain further Suspension events provided that such events do not impose Suspension events that differ materially in scope or nature from the events described in paragraph 3.2.5.

Voluntary Cessation

3.2.7 Each DIP User shall be entitled to initiate its own voluntary cessation of access to the DIP Service by giving notice in writing to the DIP Manager. The notice shall comply with the requirements of DSD002.

3.2.8 A DIP User may only give notice to the DIP Manager, and the DIP Manager may only give effect to such notice by Revoking that DIP User’s access to the DIP Service, in accordance with DSD002.

General

3.2.9 Where a DIP User is a Non-Party DIP User then, upon Revocation, the DIP Manager shall terminate that Non-Party DIP User’s Access Agreement.

3.2.10 Where a DIP User disagrees with a decision of the DIP Manager with respect to the Off-Boarding Process under this paragraph 3.2:

(a) the DIP User may refer the matter to the DCAB for determination; and

3.2.11 Where a DIP User’s access is Revoked (whether pursuant to paragraph 3.2.3 (Revocation) or 3.2.7 (voluntary cessation), then with effect from the time on the date at which such Revocation is effective (pursuant to DSD002):

(a) that DIP User’s access to the DIP Services shall be terminated, and it shall cease to be a DIP User; and

(b) subject to paragraph 3.2.12, that DIP User shall cease to have any rights or obligations under this DIP Supplement.

3.2.12 The Revocation of a DIP User’s access to the DIP Services shall be without prejudice to:

(a) those rights and obligations under this DIP Supplement that may have accrued prior to such termination; and

(b) those provisions of this DIP Supplement that are expressly or by implication intended to survive such termination (including, without limitation, any provisions relating to the Data Protection Legislation).

3.3 Information Security Obligations

3.3.1 The DIP Manager shall (and shall ensure that the DIP Service Provider shall):

(a) have appropriate practices and policies in place in respect of information security which shall be in accordance with Good Industry Practice;

(b) use all reasonable endeavours to prevent:

(i) unauthorised access to the DIP;

(ii) loss, theft or unauthorised disclosure of any Messages whilst being transmitted over the DIP;

(iii) the insertion or inclusion, or the permitting or causing any third party to insert or include any Malware into any part of the DIP.

3.3.2 Each DIP User shall:

(a) only use the DIP for the purposes contemplated by the DIP Rules including, for the avoidance of doubt, compliance with Legal Requirements, Licences and Industry Codes;

(b) only allow access to the DIP to authorised individuals;

(c) receive and hold Digital Certificates in the strictest confidence and take all reasonable security precautions in the safekeeping of Digital Certificates and in preventing unauthorised disclosure; and

(d) take reasonable steps to prevent Malware entering the DIP.

3.3.3 Without prejudice to chapter 1 of this DIP Supplement, the DIP Manager shall review and, where relevant, update all relevant requirements relating to information security, in order to ensure it remains aligned to ISO 27001.

4. ASSURANCE

4.1 Introduction

4.1.1 This chapter sets out the processes and procedures to be followed to provide assurance that the DIP Participants are complying with the DIP Rules.

4.1.2 For the avoidance of doubt, any provisions of an Industry Code that relate to the DIP shall be subject to the audit and assurance procedures in that Industry Code.

4.1.3 Assurance shall cover audit of and compliance with the DIP Rules by:

(a) the DIP Service Provider;

(b) DIP Users; and

4.2 DIP Assurance Strategy

4.2.1 The scope of the Assurance to be carried out by the DIP Manager is set out in DSD003 ‘Assurance and Reporting’ and shall include:

(a) assurance that the DIP Users are acting in accordance with the DIP Rules;

(b) undertaking audits of compliance with the DIP Rules on a continuing basis on all DIP Participants; and

(c) undertaking any such activities at such times and by such means (including for the avoidance of doubt remote desk top audits, data analysis and Artificial Intelligence (AI) or other appropriate technology) and on-site or remotely, as the DIP Manager reasonably thinks necessary.

4.2.2 Within each DIP Assurance Strategy, the DIP Manager shall:

(a) include details of Assurance to be carried out in the following DIP Year; and

(b) set out its priorities for Assurance activities for the forthcoming DIP Year.

4.3 DIP User Obligations

4.3.1 Each DIP User agrees that, by becoming a DIP Participant, it is subject to Assurance processes and procedures as are set out in the DIP Rules and will:

(a) provide the DIP Manager (or any auditor appointed by it) with such data as it may from time to time reasonably request for the purposes of fulfilling its Assurance functions;

(b) subject to receiving reasonable prior notice, (during normal business hours) provide access to its premises, records and systems (in each case to the extent relevant) to assess its compliance with the DIP Rules;

(c) provide reasonable co-operation to any auditor appointed to carry out the necessary tasks set out in this section of the DIP Rules; and

(d) follow and comply with any findings of Assurance prepared by or on behalf of the DIP Manager.

4.3.2 DIP User members of DCAB should not be present at or make decisions on any Assurance activity or entry in a DIP Assurance Strategy which affects them or the party that they represent.

4.4 DIP Manager Audit

4.4.1 The DIP Manager shall be audited on delivery of its obligations in the DIP Rules in accordance with DSD003 ‘Assurance and Reporting’.

4.4.2 The DIP Manager shall consult the DCAB on the scope of the DIP Manager Audit.

4.4.3 The DIP Manager shall publish a summary of the findings of the DIP Manager Audit. Where there are findings in the DIP Manager Audit which require rectification by the DIP Manager, then the DIP Manager will publish updates in accordance with DSD003.

5. CHANGE MANAGEMENT

5.1 Introduction

5.1.1 This chapter (together with DSD004 ‘DIP Change and Document Management’) sets out the procedures for submitting, progressing, consulting (where relevant), and approving DIP CRs in relation to the DIP and the DIP Subsidiary Documents.

5.1.2 For the avoidance of doubt:

(a) any provisions of the BSC that relate to the DIP, including this DIP Supplement, shall be subject to the Modification Procedures in the BSC; and

(b) the Modification Procedures in the BSC shall not apply to any DIP CR.

5.2 Submitting Change Requests

5.2.1 Any person (including, for the avoidance of doubt, the DIP Manager and the DCAB) may submit a DIP CR, regardless of whether or not they are a DIP User.

5.2.2 The DIP Manager shall determine whether a DIP CR is valid and may therefore be accepted and progressed.

5.3 Change Paths

5.3.1 Changes that require DCAB approval (“Tier One DIP CRs”) are DIP CRs that have a material effect on how DIP Users interact with the DIP and/or how Messages are shared, where the criteria for determining whether a DIP CR is material shall be established in accordance with DSD004 ‘DIP Change and Document Management’.

5.3.3 All other DIP CRs, including Housekeeping Changes, shall be subject to approval by the DIP Manager (“Tier Two DIP CRs”).

5.3.4 The DSDs may contain provisions setting out criteria or circumstances where:

(a) there is no requirement to consult on a DIP CR; and

(b) there is no requirement to follow a formal DIP Change process.

5.3.5 The criteria to determine materiality when considering whether a DIP CR is a Tier One DIP CR is in DSD004. Before updating the criteria, the DIP Manager shall seek the views of DIP Participants, including the DCAB.

5.4 Authority Step-in procedure

5.4.1 The DIP Manager shall inform the Authority when they or the DCAB are due to make a determination on whether to approve a DIP CR.

5.4.2 The Authority may, following a notification pursuant to paragraph 5.4.1, direct that such determination shall be made by it where the DIP CR includes:

(a) changes that are likely to have a material impact on existing or future electricity consumers;

(b) changes that are likely to have a material impact on competition in the generation, distribution, or supply of electricity or any commercial activities connected with the generation, distribution, or supply of electricity;

(d) any other DIP CR which the Authority has determined, in its absolute discretion, that it should decide (provided that any such determination must be notified to the DIP Manager by no later than five WD prior to the notified decision due date).

5.5 Prioritisation of Changes

5.5.1 The DIP Manager shall prioritise DIP CRs in accordance with any prioritisation methodology or means set out in DSD004 ‘DIP Change and Document Management’.

5.5 Withdrawal of Changes

5.5.1 Proposers may withdraw a DIP CR that they have submitted.

5.6 Implementation of Changes

5.6.1 DIP CRs that are approved in accordance with this chapter and the DSDs shall be implemented by the DIP Manager.

5.6.2 DSD004 ‘DIP Change and Document Management’ may include provisions for the changing of implementation dates for approved DIP CRs, provided that:

(a) where a DIP CR has been approved by the DCAB, then the implementation date for that Change may only be amended with the consent of the DCAB;

(b) where a DIP CR has been approved by the Authority, then the implementation date for that DIP Change may only be amended with the consent of the Authority; and

6. COST RECOVERY

6.1. Recoverable Costs

6.1.1 The DIP Manager will:

(a) calculate and be entitled to charge and to recover in accordance with this chapter of the DIP all costs and expenses (“DIP Costs”) it properly incurs under the DIP Rules; and

(b) charge and be paid in accordance with and at the times detailed in DSD005 ‘DIP Funding and Budget’.

6.1.2 DIP Costs shall be set and recovered on the basis that:

(a) the DIP Manager must propose, seek comments on and approve a DIP Budget in advance of the DIP Year to which the budget relates, in each case in accordance with DSD005;

(b) where the DIP Manager anticipates that Annual DIP Costs will or may exceed the amounts included in the DIP Budget for a DIP Year, it may revise the DIP Budget relating to that year. DSD005 may include provisions allowing the DIP Manager to exercise its discretion in revising the DIP Budget in such circumstances, provided that DSD005 must also set a reasonable threshold for such revisions which, if exceeded, will require the DIP Manager to seek comments from DIP Payees; and

6.1.3 DIP Payees invoiced shall make payments as set out in and at times mentioned in DSD005.

6.1.4 Payments will be made by those parties invoiced in accordance with DSD005.

6.1.5 The DIP Manager may, in accordance with DSD005, charge interest on payments not paid within the time for payment stipulated in the invoices and such interest payments shall be paid by the relevant DIP Payee in accordance with DSD005 and shall include provisions for the recovery of unpaid amounts (including bad debt) from DIP Payees.

6.1.6 Notwithstanding paragraph 6.1.5, a Code Body that owns or otherwise operates the DIP Manager shall not be required to:

(a) hold amounts relating to DIP Manager activities in a separate bank account; or

(b) account for DIP Costs separately in its financial statements.

7. DATA MANAGEMENT

7.1 Duty of Confidentiality

7.1.1 For the purposes of the DIP Rules:

(a) Confidential Information means:

(i) all information of a confidential nature whether in writing or otherwise that a Recipient gets from a Discloser as a result of the performance of, or exercise of the receiving Party's rights under, the DIP Rules;

(ii) without prejudice to the generality of the foregoing, any Personal Identifiable Information (PII) contained in a Message;

(b) Disclose means disclose, reveal, report, publish or transfer. 'Disclosed' and 'Disclosure' shall be construed accordingly;

(d) Recipient means the DIP Manager and each DIP User that receives Confidential Information under the DIP Rules.

7.1.2 Each Recipient must, subject to paragraph 7.2, keep all Confidential Information confidential and not Disclose it to any person.

7.2 Allowed Disclosures

7.2.1 A Recipient may Disclose or allow Disclosure of Confidential Information:

(a) where the Recipient is required or permitted to Disclose or use the Confidential Information by its Licence, the DIP Rules, an Industry Code (including, for the avoidance of doubt, the BSC) or a Nominated Agreement (as defined in the BSC) to the extent of such requirement or permission;

(b) where the person to whose affairs the Confidential Information relates gives its prior written consent to the Disclosure or use, to the extent of such consent;

(c) to the extent the Confidential Information has become publicly available or generally known to the public at the time of the Disclosure other than as a result of a breach of this paragraph 7.2;

(d) where the Confidential Information, after it is furnished to the Recipient:

(i) is acquired by the Recipient in circumstances to which paragraph 7.1 does not apply;

(ii) is acquired by the Recipient in circumstances in which paragraph 7.1 does apply and thereafter ceases to be subject to the restrictions imposed by paragraph 7.1;

(iii) enters the public domain;

and in any such case otherwise than as a result of either a breach by the Recipient of its obligations in this paragraph 7.2.1 or a breach by the person who Disclosed that Confidential Information of any confidentiality obligation of that person where the Recipient is aware of such breach by that person;

(e) where the Recipient is required or permitted to Disclose to any person Confidential Information or to use Confidential Information:

(i) in compliance with any provisions of the Data Protection Legislation, any Licence and/or the Energy Act;

(ii) in compliance with any Legal Requirement;

(iii) in response to a requirement of any recognised stock exchange; or

(iv) pursuant to any judicial or arbitral process or tribunal having jurisdiction in relation to the Recipient;

(f) and if the Recipient Discloses Confidential Information to its Affiliates, or its employees, directors, agents, consultants and professional advisers (or those of its Affiliates), in in case subject to paragraphs 7.2.3 and 7.2.4.

7.2.2 Confidential Information which a Recipient is permitted or obliged to Disclose or use pursuant to this paragraph 7.2 shall not cease to be regarded as Confidential Information by virtue of such Disclosure or use.

7.2.3 Each Recipient shall adopt procedures within its organisation for ensuring the confidentiality of all Confidential Information, including the following:

(a) Confidential Information will be disseminated within its organisation on a "need-to-know" basis;

(b) employees, directors, agents, consultants and professional advisers of the Recipient in receipt of Confidential Information will be made fully aware of the provisions of paragraph 7.1; and

7.2.4 Each Recipient shall take all reasonable steps to ensure that any person referred to in paragraph 7.2.1(f) and 7.2.3(b) to whom the Recipient Discloses the Confidential Information does not use that Confidential Information for any purpose other than that for which it is provided and does not Disclose that Confidential Information otherwise than in accordance with this paragraph 7.2.

7.3 Security Breaches

7.3.1 In the event of a suspected Security Breach:

(a) any DIP Participant that is aware of the suspected Security Breach shall report such incident to the DIP Manager as soon as reasonably practicable;

(b) the DIP Manager shall take all appropriate measures relating to resolving the suspected Security Breach, including:

(i) suspending access to the DIP in accordance with DSD002 ‘DIP Connection and Operation’; and

(ii) notifying all potentially impacted DIP Participants;

(c) the DIP Manager and each relevant DIP User shall co-operate in good faith and in a timely manner with each other in taking any of the steps set out in DSD002.

7.4 Ownership of data

7.4.1 Except as explicitly set out in the DIP Rules, nothing in the DIP Rules shall operate to transfer ownership of the Intellectual Property Rights (IPRs) in any of the Messages or any data contained in such Messages. For the avoidance of doubt, and for the purposes of the DIP Rules, the ownership of such IPRs shall be determined in accordance with the provisions of the Industry Code that determines the Message interface.

7.4.2 Where any provision of the DIP Rules permits the DIP Manager to access the data contained in any Messages, or requires DIP Users to give any such permission to the DIP Manager:

(a) each such DIP User grants to the DIP Manager a non-exclusive licence to use such data to the extent necessary and solely for the purposes contemplated by the DIP Rules, together with the right to sub-license the use of such data as necessary solely for those purposes; and

(b) each such DIP User shall (without payment) use all reasonable endeavours to ensure that, and warrants to the DIP Manager in respect of such data that the use and disclosure of all such data by the DIP Manager (and any of its sub-licensees pursuant to paragraph 7.4.2(a)) pursuant to, or as and for the purposes contemplated, by the DIP Rules will not, as far as it is aware, infringe the IPRs of any person, or be contrary to any obligations of confidence or be in breach of any obligation or duty to any third party and each DIP User hereby indemnifies the DIP Manager in respect of any loss, liability, damages, costs (including legal costs), expenses, claims and proceedings which such relevant person may suffer or incur by reason of any breach by that DIP User of its obligations under this paragraph 7.4.2.

7.4.3 The DIP Users agree that, the IPRs in and title to the DIP Materials and the DIP Manager Data shall be owned by the DIP Manager.

7.4.4 Each DIP Participant hereby assigns to the DIP Manager by way of assignment of all present and future rights in all IPRs it may have at any time in the DIP Materials and/or DIP Manager Data (except to the extent those rights are already owned by the DIP Manager).

7.4.5 By virtue of this paragraph 7.4, all IPRs in the DIP Materials and the DIP Manager Data will vest in the DIP Manager on their creation or acquisition.

7.4.6 Each DIP User shall do all things and sign all documents or instruments reasonably necessary, in the opinion of the DIP Manager, to enable the DIP Manager to obtain, perfect and prove its rights in the DIP Materials and the DIP Manager Data.

7.4.7 Each DIP User hereby waives, or shall use all reasonable endeavours to procure that the owner of any moral rights in the DIP Materials and the DIP Manager Data waives, all such moral rights as may arise in them.

7.4.8 Insofar as the DIP Manager is permitted, subject to the rights of any third party in respect thereof, the DIP Manager hereby grants to each DIP User a royalty-free, non-exclusive, non-transferable licence (including a right to grant sub-licences to contractors for the same purpose) to:

(a) use the DIP Materials to the extent necessary and solely for its business in connection with the arrangements established under the DIP Rules, together with the right to sub-license the use of such materials as necessary solely for those purposes; and

(b) to use that DIP Manager Data for the purpose of receiving the relevant DIP Service(s) in accordance with the DIP Rules.

7.5 Use of DIP Manager Data

7.5.1 The DIP Manager shall make DIP Manager Data available in accordance with the open data principles and procedures set out in DSD006 ‘Data Management’.

7.5.2 Any person may submit to the DIP Manager a request for disclosure of any DIP Manager Data that is not otherwise available to that DIP User or person. The DIP Manager shall process such request in accordance with the open data principles and procedures set out in DSD006.

7.5.3 Without prejudice to paragraph 7.5, each DIP User hereby consents irrevocably and unconditionally to the disclosure of DIP Manager Data pursuant to this paragraph.

7.6 Data Protection General

7.6.1 For the purposes of the DIP Rules:

(a) "Commisioner" has the meaning given to that term in the Data Protection Legislation;

(b) "Controller" has the meaning given to that term in the Data Protection Legislation;

(f) "Data Subjects" has the meaning given to that term in the Data Protection Legislation;

(g) "Permitted Purpose" means:

(i) where the DIP Manager is a Processor or Sub-processor, the provision of the DIP Service in accordance with the DIP Rules;

(ii) where a DIP User is acting as a Processor, the performance of any obligations under the DIP Rules or any relevant Industry Code;

(h) "Personal Data" has the meaning given to that term in the Data Protection Legislation;

(i) "Personal Data Breach" has the meaning given to that term in the Data Protection Legislation;

(j) "Process" and "Processing" has the meaning given to those terms in the Data Protection Legislation;

(k) "Processor" has the meaning given to that term in the Data Protection Legislation; and

(l) "Sub-processor" means a person appointed by a Processor to process Personal Data.

7.6.2 Words and expressions used in this paragraph 7 and not defined elsewhere in the DIP Rules or the BSC shall be interpreted in accordance with any meaning given to them in the Data Protection Legislation.

7.6.3 The DIP Users acknowledge and agree that:

(a) Messages transmitted under the DIP Rules may contain Personal Data;

(b) where a DIP User is a Controller in relation to the Personal Data that it sends or receives through the DIP, the DIP Manager is a Processor for the purposes of providing the DIP Service and, accordingly, may Process any such Personal Data for the purpose of providing the DIP Service; and

(c) where a DIP User is a Processor in relation to the Personal Data that it sends or receives through the DIP, the DIP Manager is a Sub-processor for the purposes of providing the DIP Service and, accordingly, may Process any such Personal Data for the purpose of providing the DIP Service.

7.7 DIP Data Controller Obligations

7.7.1 This paragraph 7.7 sets out the obligations of any DIP User when they are acting as a Controller in respect of the Processing of Personal Data for the Permitted Purpose.

7.7.2 Each DIP Data Controller confirms that it has effected, and undertakes that it shall maintain, all such notices and registrations as it is required to effect and maintain under the Data Protection Legislation to enable it lawfully to perform the obligations imposed on it by the DIP Rules, and exercise the rights granted to it by the DIP Rules.

7.7.3 Each DIP Data Controller undertakes to comply with the Data Protection Legislation in the performance of the DIP Rules, including ensuring, in respect of Personal Data to be shared or otherwise Processed pursuant to the DIP Rules, that the DIP Data Controller has a lawful basis for such sharing and other Processing.

7.7.4 Without limiting Clause 7.7.3, each DIP Data Controller shall:

(a) provide to relevant Data Subjects, the information required by the Data Protection Legislation to be provided by them in respect of the Processing of Personal Data;

(b) comply with the Data Protection Legislation as regards the exercise of rights by Data Subjects in respect of Personal Data for which it is the Controller. In particular, each DIP Data Controller shall designate its own contact point responsible for dealing with data protection queries, requests or complaints raised by relevant Data Subjects; and

(c) be responsible for, and shall make its own determination as regards, notifying the Commissioner and Data Subjects (if applicable) in case of a Personal Data Breach relating to the Personal Data in accordance with Data Protection Legislation.

7.8 Data Processor Obligations

7.8.1 This paragraph 7.8 sets out the obligations of the DIP Manager and any DIP User when they are acting as a Processor or Sub-processor in respect of the Processing of Personal Data for a Permitted Purpose.

7.8.2 To the extent that a DIP User has:

(a) been appointed as a Processor in respect of any Personal Data being sent or received through the DIP; and

(b) has entered into a direct 'controller-processor' agreement with a Controller with respect to that Processing;

then it shall be subject to that direct agreement and not this paragraph 7.8.

7.8.3 Where a DIP User acts as a Processor pursuant to the DIP Rules it is assumed to have a direct ‘controller-processor’ agreement in place with a Controller with respect to such processing.

7.8.4 Each Processor shall:

(a) only Process that Personal Data for the Permitted Purpose, and/or as otherwise instructed in writing from time to time, and not in a manner that the Processor knows (or should reasonably know) is likely to cause the DIP Data Controllers to breach their obligations under the Data Protection Legislation (subject to paragraph (b) below);

(b) if the Processor is aware that, or is of the opinion that, any requirement of paragraph (a) above breaches the Data Protection Legislation, the Processor shall immediately inform the relevant DIP Data Controller of this giving details of the breach or potential breach (unless the Processor is prohibited from doing so by any of its other obligations under law);

(d) ensure that the Processor's personnel who are authorised to Process Personal Data are under enforceable obligations of confidentiality;

(e) (having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects) implement appropriate technical and organisational measures (including any such measures specified in the DIP Rules) to ensure that the Personal Data is Processed in compliance with the Data Protection Legislation and is protected against accidental or unlawful loss, destruction, damage, alteration or disclosure;

(f) (taking into account the nature of the Processing and the information available to the Processor) assist DIP Data Controllers with their obligations to comply with Data Subject requests and Data Subjects' rights under the Data Protection Legislation in respect of that Personal Data (through, insofar as is possible, the use of appropriate technical and organisational measures);

(g) provide reasonable assistance to DIP Data Controllers in complying with any enquiry made, or investigation or assessment initiated, by the Commissioner in respect of the Processing of that Personal Data;

(h) as soon as practicable notify the relevant DIP Data Controller in the event that the Processor becomes aware of a Personal Data breach in relation to Personal Data;

(i) provide all such reasonable and timely assistance as the DIP Data Controller may reasonably require in order to conduct a data protection impact assessment in accordance with Data Protection Legislation;

(j) upon termination or expiry of the DIP Services, destroy the Personal Data that is within its possession or control (including where subcontracted to a third party); save that this requirement shall not apply to the extent that the Processor: (i) is required by a Legal Requirement to retain the Personal Data; and/or (ii) continues to process the Personal Data for other lawful purposes (either as a Controller or as a Processor on behalf of other Controllers); and

(k) permit the DIP Manager (on behalf of DIP Data Controllers collectively), to audit compliance with this paragraph 7.8 and make available to on request from all information reasonably necessary to demonstrate such compliance.

7.8.5 Each Processor shall ensure that its sub-processors, in respect of the Personal Data, are subject to written contractual obligations in respect of the Processing of that Personal Data which are the same as the Processor obligations under the DIP Rules.

7.8.6 Each DIP Data Controller hereby gives each Processor general authorisation to engage sub-processors who are appointed in accordance with the requirements of the DIP Rules. Each DIP Data Controller hereby confirms that it does not object to the engagement of any sub-processors engaged in accordance with such requirements. Where a sub-processor is appointed in accordance with this paragraph, the Processor shall maintain a list of sub-processors (including details of the processing it performs or will perform) and provide such list of sub-processors to the DIP Manager, (on behalf of DIP Data Controllers collectively), on request.

7.8.7 Notwithstanding such general consent to appointment of sub-processers under paragraph 7.8.6, if a DIP Data Controller objects to the appointment of a sub-processor on reasonable grounds relating to the protection of Personal Data, the Processor will not permit Processing of Personal Data by such sub-processor

7.8.8 Each Processor shall, where acting as a Processor of the Personal Data on behalf of one or more DIP Data Controllers, not transfer or process the Personal Data outside the United Kingdom and European Economic Area unless the Processor:

(a) has first obtained the DIP Manager’s approval (on behalf of DIP Data Controllers collectively); and

(b) takes such measures as are necessary to ensure the transfer is in compliance with Data Protection Legislation, which may include transferring the Personal Data to a recipient: (i) in a country that the Secretary of State has decided provides adequate protection for Personal Data; (ii) that has achieved binding corporate rules authorisation in accordance with Data Protection Legislation; or (iii) that has executed relevant standard contractual clauses adopted or approved by the Secretary of State or otherwise permitted by the Data Protection Legislation.

AMEDNMENT RECORD – DATA INTEGRATION PLATFORM SUPPLEMENT

DIP Supplement

Version 1.0

Effective Date: 01 October 2024

Modification Proposal	Approval Date	Implementation Date	Version
P474	08/08/2024	01/10/2024	1.0

CONTENTS

DIP Supplement V1.0

1. GENERAL

1.1 Introduction