CIPM: Certified Information Privacy ManagerDemo

Question

Select 3 of the following 5 options. No partial credit is given.

A multinational manufacturing company is considering outsourcing its HR-data processing to a third-party vendor located in a country with less stringent data-protection laws. The company holds a large database of employee information, including personal and sensitive data such as national ID numbers, medical information, and employment contracts.

The third-party vendor is known for offering cost-effective services and has assured the company that it can process the data securely.

Which of the following contractual requirements should the data protection officer (DPO) ensure are included in the agreement with the third-party vendor?

Choose three

A How a breach would be handled.
B How the vendor is insured.
C How data transfers take place.
D How appropriate security will be maintained.
E How the cost of doing business will be reduced.

Explanation

A controller–processor contract must require appropriate technical and organisational measures to protect personal data, address the processor’s duties to notify and assist with personal-data breaches, and restrict processing—including transfers to a third country—to the controller’s documented instructions. Insurance arrangements and cost reductions are commercial matters, not mandatory data-processing terms.

Learn more

CIPM: Certified Information Privacy ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ332

Community Discussion