Vendor monitoring and yearly review

Choosing a provider carefully is not a one-off task. The GDPR expects you to use only processors that offer sufficient guarantees (Article 28), and those guarantees can change after you sign up: a new subprocessor, a new data location, a lapsed certification. Privacyboard helps you keep an eye on your vendors in three ways.

#The yearly review

Open a vendor and scroll to Yearly review, at the end of its agreement section. It shows when you last reviewed the vendor and when the next review is due.

To review a vendor:

1. Check that its processing agreement still covers the service you use and how you use it.
2. Look at its subprocessor list, and at how it announces changes.
3. Check where it keeps your data, and update the region if it changed.
4. Click Mark as reviewed. Today's date is recorded, and the next review falls due 12 months later.

A vendor never reviewed, or last reviewed more than 12 months ago, shows Review due in the vendor list. Choose Review due in the filter to see only those.

#Data Privacy Framework alerts

Many US providers rely on the EU-U.S. Data Privacy Framework (DPF) for transfers. Privacyboard checks the official list every week for the providers it knows, and the vendor dialog, transfer impact assessments and documents use the status from the latest check.

When a provider you rely on is no longer usable under the DPF, you get an urgent reminder. That happens when its entry becomes inactive or withdrawn, when its re-certification date passes without renewal, or when it stops covering customer (non-HR) data. You rely on the DPF for a vendor when its safeguard is set to Data Privacy Framework, or when it has no safeguard of its own and the transfer used its certification or your company default is the DPF.

A provider whose entry reads "Active - Re-certification under Review" before its re-certification date is still on the list, so no alert is sent.

#Agreement changes, subprocessor changes and incidents

Every week, Privacyboard re-reads the processing agreement page and the subprocessor list of the vendors in use, and looks at public sources of security incidents: the Have I Been Pwned list of data breaches and the CISA catalog of vulnerabilities known to be exploited.

What it finds is first checked by the Privacyboard team, so a menu change on a vendor's website or an unrelated product does not reach you. When a change or an incident is confirmed, every workspace that uses the vendor gets a reminder with a short explanation and a link to the source:

• Agreement or subprocessor list changed: read the change, decide whether it still suits you (for example a new subprocessor outside the EEA), then review the vendor. Under most processing agreements you can object to a new subprocessor within a set period.
• Reported data breach: check whether your account or your data is affected. If personal data you are responsible for is involved, record it in Incidents.
• Exploited vulnerability: check whether you use the affected product and apply the vendor's fix.

#Who gets the reminders

Reminders are part of the daily email digest on the Pro and Business plans, sent to the people who follow privacy requests (owners and admins unless they chose otherwise). Each reminder is sent once: the yearly review reminder lists every vendor due, at most once a quarter, a DPF alert is sent again only if the provider's status changes again, and each confirmed change or incident is sent once.

#FAQ

#Do I have to review every vendor every year?

It is good practice for every processor, since the GDPR asks you to keep checking that processors offer sufficient guarantees. Start with the vendors that handle the most sensitive data or that are outside the EEA.

#What does Privacyboard check during the yearly review?

Nothing on its own: the review is your check of the agreement, the subprocessors and the data location. Mark as reviewed records the date so you, your team and an auditor can see it was done.

#How often is the Data Privacy Framework list checked?

Every week. The vendor dialog and your documents use the status from the latest check.

#Who decides that a vendor change is worth an alert?

The Privacyboard team reads each change or incident found by the weekly check before it is sent, and adds a short note. Nothing is sent automatically from a website change alone.

#Why did I get a DPF alert for a vendor I have not changed?

The provider's entry on the official list changed: it became inactive, was withdrawn, or passed its re-certification date. Your records still rely on the certification, so the transfer needs another safeguard.