Workshop 10
Vendors, Processors & Applications

Back to the DPO Guide

Vendors, Processors & Applications

This workshop brings the applications and vendors that process personal data under control: inventory, vendor assessments, processing agreements, international transfers and ongoing monitoring.

Workshop tasks

1. 1. Application inventory

   List every application holding personal data, including cloud services: owner, deployment, hosting country and contract with the provider.

   In ResGuard: Applications

2. 2. Vendor inventory

   Identify vendors with access to data using the RoPA recipients, classify them (processor or controller) and rate their criticality.

   In ResGuard: Vendor Management

3. 3. Vendor assessments

   Send security and privacy questionnaires to critical vendors, review certifications such as ISO 27001 and record the result. ResGuard's AI can pre-fill the questionnaires.

   In ResGuard: Vendor Management

4. 4. Processing agreements

   Put a contract in place with every processor: instructions, confidentiality, security, sub-processors, support with requests and incidents, and return or deletion of data.

5. 5. International transfers

   Identify where data is stored and accessed from, and document the transfer mechanism accepted by the law.

   In ResGuard: Applications

6. 6. Ongoing monitoring

   Assess new vendors before use, re-assess critical vendors every year and manage the exit when a contract ends.

   In ResGuard: Vendor Management

7. 7. Workshop review & close-out

   Review the results, attach evidence and close the objective in ResGuard.

   In ResGuard: Objective Manager

Expected result

• Complete inventory of applications and vendors
• Critical vendors assessed
• Processing agreements in place
• International transfers documented

ResGuard modules: Applications, Vendor Management, AI-supported vendor assessment