Question

A privacy solutions engineer is reviewing the organization's third-party management program. A key marketing SaaS provider was onboarded two years ago with a signed data processing agreement, but there has been no interaction with the vendor since. The provider recently expanded its subprocessing to a new offshore analytics firm. Which action would MOST effectively strengthen ongoing third-party privacy oversight?

Accepted Answer

Establish a continuous vendor monitoring process with contractual rights to audit, subprocessor change notifications, and periodic reassessment

Answer

Require the vendor to re-sign the original data processing agreement each year without modification

Answer

Terminate the vendor relationship because a new subprocessor was engaged

Answer

Rely on the vendor's published privacy notice to confirm continued compliance