Vendors, Data Intermediaries & Transfers
This workshop brings the applications and vendors that process personal data under control: inventory, vendor assessments, contracts with data intermediaries, transfers outside Singapore and ongoing monitoring.
Workshop 10 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Vendor management with questionnaire templates for security and privacy assessments
- AI-supported answers to speed up vendor assessments
- Application inventory with hosting countries for transfer checks
- Template for the data processing agreement
Workshop tasks
-
1. Application inventory
List every application holding personal data, including cloud services: owner, deployment, hosting country and contract with the provider.
In ResGuard: Applications -
2. Vendor inventory
Identify vendors with access to data using the recipients in the inventory, classify them (data intermediary or organisation) and rate their criticality.
In ResGuard: Vendor Management -
3. Vendor assessments
Send security and privacy questionnaires to critical vendors, review certifications such as ISO 27001 or DPTM and record the result. ResGuard's AI can pre-fill the questionnaires.
In ResGuard: Vendor Management -
4. Data intermediary contracts
Put a contract in place with every data intermediary: purpose, confidentiality, protection, retention, sub-contracting, breach reporting, and return or disposal of data.
-
5. Overseas transfers
Identify where data is stored and accessed from, and document how a comparable standard of protection is ensured for each transfer.
In ResGuard: Applications -
6. Ongoing monitoring
Assess new vendors before use, re-assess critical vendors every year and manage the exit when a contract ends.
In ResGuard: Vendor Management -
7. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- The organisation stays responsible for personal data processed on its behalf by a data intermediary. Data intermediaries themselves must meet the Protection and Retention Limitation obligations and notify you of data breaches without undue delay.
- Transfers outside Singapore need a comparable standard of protection, for example through contracts, binding corporate rules or certifications such as APEC CBPR or PRP.
- Many cloud services host data outside Singapore: review them with particular care.
Expected result
- Complete inventory of applications and vendors
- Critical vendors assessed
- Contracts with data intermediaries in place
- Overseas transfers documented
ResGuard modules: Applications, Vendor Management, AI-supported vendor assessment