New Supplier GDPR Risk Assessment / questions

[tj2419]

I have just had the usual, "Here's a new cloud-based piece of software we have bought into", no warning.

 

From the looks of it no effort has been made to check it out from a GDPR aspect.

 

Would this be where you would carry out a risk assessment? Any templates?

 

Does anyone have a set list of questions you ask of a new supplier before agreeing to purchase software from them? If so could I have a copy?

 

Thanks

[Brimstone]

What is it called...?

[DrBeaker]

What is it called...?

 

Google, Microsoft or Apple...take your pick.

[Ditto]

I have just had the usual, "Here's a new cloud-based piece of software we have bought into", no warning.

 

From the looks of it no effort has been made to check it out from a GDPR aspect.

 

Would this be where you would carry out a risk assessment? Any templates?

 

Does anyone have a set list of questions you ask of a new supplier before agreeing to purchase software from them? If so could I have a copy?

 

Thanks

Ask them to get DPO sign-off before you are willing to deal with it.

[AndyCrow]

Whoever within the school signed off on it should have done a Data Protection Impact Assessment (DPIA). This is basically a risk assessment under GDPR. If it hasn't been completed you could raise concerns with the DPO as this will cover you should there be an issue going forward. More info and a template to use are on the ICO website.

[blueday]

ICO's guidance on DPIA's

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/ and

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/

 

You should also be checking the software company's compliance as a data processor, there's a useful checklist here (the answers to which may also be needed to complete a DPIA):

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/controllers-and-processors/what-does-it-mean-if-you-are-a-processor/#1

[rom1984]

I've not got any specific templates but one of the things I like to look at for cloud service providers is if the company is registered on the Cloud Security Alliance's STAR register (Security Trust Assurance and Risk Register).

 

You can search them on this link;

https://cloudsecurityalliance.org/star/registry/

 

It allows an organisation to complete an assessment against the CSA's own cloud security controls. Depending on the type of organisation it is either self-assessed or via a third party audit. You can then use this as proof as your due diligence in regards to the security of the organisation.

 

You can also ask if the organisation follows a particular security model or framework, for example the NCSC Cyber Essentails, ISO2700, NIST 500 etc

 

I also like to see particular KPI or SLA that allow the organisation to monitor the security of the organisation. For example, a policy or procedure that states an annual check on the company to confirm if they are still maintain particular security certifications etc (if relevant).

 

Reference are also a good way to demonstrate due-diligence, so if you know a school that already uses the particular software you can ask them about it from a DP compliance point of view (I.e can you easily delete personal data, does it allow different levels of access etc)

 

Do you believe the new system will be processing personal data that is likely to result in a high risk? If so, as above, you will be required to do the DPIA as a requirement.