Your Obligations to Your Customers

Answering Security Questionnaires Answering security questionnaires means responding to the security and privacy questions a customer sends before it buys or renews, and many of those answers depend on what your own vendors do and promise. Back-to-Back Terms Back-to-back terms means the promises you make to your customers are backed by matching promises from your vendors, so you never commit to more (faster notice, higher uptime, wider liability) than your own vendors commit to you. Customer DPA Request A customer DPA request is when a customer asks you to sign a data processing agreement, the contract that sets out how you, as their vendor, handle the personal data they share with you and which subprocessors you use. Data Protection Impact Assessment (DPIA) A data protection impact assessment (DPIA) is a written review, required by the GDPR for high-risk uses of personal data, that describes the plan, its risks to people and how you will reduce them, before you start. Data Subject Access Request (DSAR) A data subject access request (DSAR) is a person's request to see the personal data you hold about them, and often to delete or correct it, which you must answer within a legal deadline, including data held by your vendors. How to Notify Customers of a New Subprocessor Notifying customers of a new subprocessor means telling them, before the change takes effect, that a new outside company will handle their personal data for you, so they can review it and object if your contract allows. How to Publish Your Own Subprocessor List Publishing your own subprocessor list means posting a public page that names every outside company that handles your customers' personal data, what each one does and where, and keeping it current as your vendors change. Records of Processing Activities (RoPA) Records of processing activities (RoPA) is the internal list the GDPR requires of how you use personal data: why, whose data, which vendors receive it, where it goes and how long you keep it.