(Updated with information on VCDPA on 19th March, 2021)

For a long time experts have warned about supply chain and supplier risk. Vendor and 3rd party management practices, which previously were seen as elements of a mature security governance program, have become standard elements of new data protection law. But are organizations actually aware of the newly introduced requirements? We summarize the relevant regulations and requirements to look out for.

While phrased differently by the individual laws we are analyzing here, the core requirements are very similar. They can hence be met by applying one generalized process across jurisdictions. Additionally to the core requirements called out in the law, there are guidance documents and best practices which will also determine how to shape your vendor management.

Comply with data protection regulation (GDPR Art.28(1), CCPA 1798.140(w)(2)(A)(ii), VCDPA 59.1-575.(C), PDPA SDPC 2.1)

Number one requirement of any data protection law is to guarantee that anyone receiving personal data under that law understands and follows it. While the specific responsibilities of a supplier might be lighter under the law, they still need to abide to a number of requirements and this needs to be called out in their DPA.

Follow instructions set out in agreement (GDPR Art.28(3)(a), CCPA 1798.140(v), VCDPA 59.1-575.(B), PDPA SDPC 2.2(a)):

Data processors are required to keep the received personal data confidential and only process it as needed or as it relates to providing the services of the agreement and as put in writing in the DPA. Sometimes, documented instructions are interpreted as the whole of functionality available through the supplier's configuration interface and which the user has set up. Only exception to this requirement are data processing activities that are required to meet the supplier's own legal obligations.

Technical and organizational measures to safeguard personal data (GDPR Art.28(1), CCPA 1798.140(v), VCDPA 59.1-575.(A)(2), PDPA SDPC 2.4):

New data protection regulations have increased the security requirements surrounding personal data. This includes requirements for technical protection, like circumstances where encryption is needed, as well as organizational measures, such as regular testing and incident response. While the CCPA does not specifically call out these requirements for suppliers, it does say that data processors become liable in case they don't follow instructions of the agreement, and hence the CCPA motivates businesses to introduce such requirements. Additionally, security breach requirements remain in force in California and also the new California Privacy Rights Act (CPRA Section 4) will introduce security clause requirements into the DPAs.

Retention (GDPR Art.28(3)(g), CCPA 1798.140(v), VCDPA 59.1-575.(B)(2), PDPA SDPC 2.7):

As a natural consequence of only being allowed to use personal data according to the instructions of the agreement, personal data needs to be deleted or returned at the end of the service period. As return of the data might result in a heavy process, most agreements already include the choice of deletion, but providing access and export capabilities during the service period are more and more looked for.

No matter whether you are a data controller or a data processor, above requirements mean that you'll have to maintain a number of DPAs. Preferably, these DPAs set out the same requirements across your business relations, but often you'll just have to accept the terms that are given to you. PASERO provides you three essential tools that help you stay on top of these DPAs:

• Decrease time to compliance: With our database of top suppliers and instructions on how to get DPAs signed, you can quickly meet the requirements of a written agreement and will have all relevant information at one place when needed.
• Automate supply-chain disclosure requirements: As soon as you select a supplier within PASERO, we can automatically generate you an HTML page to be included in your privacy policy, an RSS feed to be shared with your customers, and email notifications of the changes. In case all your customers accept the change, you are already done.
• Get an overview of your DPA terms (coming): Unfortunately, it is rarely the case that all DPAs have the same terms for all topics. But PASERO can help you in making your business decisions by showing you a comparision of the key differences.