72. The contractor must nominate a person with responsibility for practices and procedures relating to the confidentiality of personal data held by it.