Time how long it takes to leave each sub-processor

How to do it

A buyer inherits every vendor contract. A vendor that holds customer data with no export is a lock-in the price should reflect. Start from the company's register in Keep one register of vendors and compare it with the invoices and the outbound hosts in the code. A vendor in the invoices but not in the register is a finding. For each vendor, record the export format and who on the team has done an export. Note whether the contract requires deletion or return of the data at the end, as GDPR Article 28(3)(g) does. Deletion on exit follows Confirm deletion when a vendor leaves.

Examples

Python example

def exit_findings(vendors: list[dict], invoiced: set[str]) -> list[str]:
    registered = {vendor["name"] for vendor in vendors}
    findings = [f"{name}: invoiced but not in the vendor register" for name in invoiced - registered]
    findings += [f"{vendor['name']}: no export path" for vendor in vendors if not vendor.get("export_path")]
    return findings

JavaScript example

function exitFindings(vendors, invoiced) {
  const registered = new Set(vendors.map(vendor => vendor.name))
  return [
    ...[...invoiced].filter(name => !registered.has(name)).map(name => `${name}: invoiced but not in the vendor register`),
    ...vendors.filter(vendor => !vendor.exportPath).map(vendor => `${vendor.name}: no export path`),
  ]
}

How to check

Every vendor in the invoices of the last 12 months appears in the report with data held, export path and time to leave. Each vendor without an export path has a finding with a severity.

Sources

• GDPR, Regulation (EU) 2016/679, Article 28

Related rules

• CMP-13 Keep one register of vendors in Compliance and governance
• CMP-20 Confirm deletion when a vendor leaves in Compliance and governance