Question group
Privacy and data subject rights
Personal data questions. Some are the supplier's to answer as a processor; others are the customer's own duties as controller, put to the supplier by habit.
The families
4 families| Family and a typical question | ISO 27001 | Evidence expected |
|---|---|---|
| Data subject requestsHow do you handle data subject access and erasure requests? | 5.34 | The procedure for passing a data subject request to the customer and assisting with it, with the time the supplier commits to. |
| Lawful basis, consent and privacy noticeWhat is your lawful basis for processing personal data? | 5.34 | For a processor, the processing instructions in the contract; the lawful basis and the notice to the people concerned are the controller's own records. |
| Data processing agreementWill you sign our data processing agreement? | 5.34 | The supplier's processing terms checked against the stipulations of GDPR Article 28(3), and the flow-down terms used with its own subprocessors. |
| Health information and business associate termsWill you sign a business associate agreement for the protected health information we share? | none | The business associate agreement terms the supplier will sign, and the safeguards that apply to protected health information in the service. |