Agent WranglersProcessors and transfers Recommended
Confirm deletion when a vendor leaves
When you stop using a vendor, get written confirmation that it deleted or returned your data, before you remove it from the register.
How to do it
Article 28(3)(g) makes deletion or return part of every processor contract. Revoke its keys and accounts on the last day. Ask for a deletion confirmation with a date. Keep the closed entry with that date for as long as your audit evidence is kept.
How to check
A script fails on any vendor ended over 30 days ago without a deletion_confirmed date. It also fails when its API key is still active.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-exit.