Vendors, Processors & Applications
This workshop brings the applications and vendors that process personal data under control: inventory, vendor assessments, processing agreements, international transfers and ongoing monitoring.
Workshop 10 video
Walkthrough of the workshop and its tasks — coming soon
What ResGuard provides
- Vendor management with questionnaire templates for security and privacy assessments
- AI-supported answers to speed up vendor assessments
- Application inventory with hosting countries for transfer checks
- Template for the data processing agreement
Workshop tasks
-
1. Application inventory
List every application holding personal data, including cloud services: owner, deployment, hosting country and contract with the provider.
In ResGuard: Applications -
2. Vendor inventory
Identify vendors with access to data using the RoPA recipients, classify them (processor or controller) and rate their criticality.
In ResGuard: Vendor Management -
3. Vendor assessments
Send security and privacy questionnaires to critical vendors, review certifications such as ISO 27001 and record the result. ResGuard's AI can pre-fill the questionnaires.
In ResGuard: Vendor Management -
4. Processing agreements
Put a contract in place with every processor: instructions, confidentiality, security, sub-processors, support with requests and incidents, and return or deletion of data.
-
5. International transfers
Identify where data is stored and accessed from, and document the transfer mechanism accepted by the law.
In ResGuard: Applications -
6. Ongoing monitoring
Assess new vendors before use, re-assess critical vendors every year and manage the exit when a contract ends.
In ResGuard: Vendor Management -
7. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Chile
- Processing by a processor (encargado or mandatario) requires a contract setting out the subject matter, duration, purpose, types of data and the obligations of both parties.
- International transfers are only allowed to countries the Agency considers adequate, or with safeguards such as contractual clauses or binding corporate rules, unless an exception in the law applies.
- Many cloud services host data outside Chile: review them with particular care.
Expected result
- Complete inventory of applications and vendors
- Critical vendors assessed
- Processing agreements in place
- International transfers documented
ResGuard modules: Applications, Vendor Management, AI-supported vendor assessment