Processors and transfers

Required

• Keep one register of vendors

  Required

  Keep one register of every vendor that handles personal data or reaches production. Fail the build when the code uses a vendor not in it.

• Check each agreement covers Article 28

  Required

  Check every data processing agreement against the list in GDPR Article 28(3), and record the result and the breach notice deadline in the vendor register.

• Publish your subprocessors

  Required

  If you process personal data for business customers, publish your subprocessor list at a stable address and tell customers before you add one.

• Record a legal basis for every transfer

  Required

  For every store or vendor outside the European Economic Area, record the transfer basis under GDPR Chapter V. Contract clauses also need a transfer impact assessment.

• Check the Data Privacy Framework status of US vendors

  Required

  Rely on the EU-US Data Privacy Framework only for US vendors on its active list. Check the list monthly and keep signed contract clauses as a fallback.

• Rank vendors and check their evidence

  Required

  Rank every vendor by the data and access it has, and require current security evidence for the top tier.

• Record the data terms of every AI provider

  Required

  Give every AI model provider a vendor register entry with its plan, its training setting, its retention and its region. Allow only plans that do not train on your data.

Recommended

• Confirm deletion when a vendor leaves

  Recommended

  When you stop using a vendor, get written confirmation that it deleted or returned your data, before you remove it from the register.