Question

A retail organization is onboarding a new cloud-based marketing analytics provider that will process customer personal data on the organization's behalf. The privacy officer is asked to advise the procurement team before the contract is signed. Which action provides the GREATEST assurance that the organization's privacy obligations will be met throughout the relationship?

Accepted Answer

Require the vendor to complete a privacy and security due diligence assessment and include contractual data protection clauses with audit rights before signing

Answer

Rely on the vendor's published privacy policy and public trust seals as evidence of adequate protection

Answer

Have the vendor sign a general confidentiality agreement covering all shared information

Answer

Defer the privacy review until after the vendor has begun processing data so real-world practices can be observed