How Vendor Privacy Risk Monitoring and Ratings Work

As discussed earlier, controllers and processors must ensure that all vendor partners comply with regulatory privacy requirements. Most regulations mandate ongoing, periodic assessments to ensure privacy compliance guidelines are followed. In addition to getting a privacy assessment completed by a vendor and gathering evidence related to the vendor’s compliance, it is also beneficial to obtain an independent evaluation of a vendor’s privacy risk. This evaluation allows organizations to develop an effective strategy for data protection, risk management, and compliance. 

Vendor Explorer capability in PrivacyOps is a library of personal data processors that have already been investigated and rated by the PrivacyOps research team.  Organizations can use this tool to locate vendors by name and by their Rating. Organizations can also use the Vendor Explorer to quickly request that a vendor submit an assessment for them to evaluate. When assessing the risk associated with a vendor, PrivacyOps considers three main points; data protection practices of vendors, their privacy violations, and respect for consumers’ data.

The Privacy Score provides an independent view of privacy practices of a vendor, as calculated based on privacy statements and data available about a vendor.

1. Data Protection

Data protection comprises the vendor processes to protect the data that it collects, processes, and shares. This includes the technical and security measures that the vendor performs to protect the data. For rating and Privacy scores, the PrivacyOps research team assess risks around:

• Data Collection: Analyze risks around the vendor’s data collection and use processes, including mandatory notification requirements under relevant privacy regulations. It also analyzes the ability to obtain explicit consent from users and the particular handling of underage consumers.

• Data Storage: Analyze risks around the vendor’s data storage and data retention capabilities to understand how effective they are in keeping sensitive data safe and secure. Critical capabilities analyzed should include transport-level encryption, encryption at rest, access control mechanisms, fault tolerance, retention and backup capabilities, and forensic event logs for effective alerting, reporting, and policy actions.

• Data Sharing: SaaS, IaaS, and PaaS vendors acquire volumes of data about their customers, which could be misused, leaked, or sold to other vendors, increasing its risk. It’s essential to review and understand how the data is analyzed or monetized by a vendor. Other critical risk factors to examine are the financial incentives baked into contracts and agreements to collect and sell personally identifiable information.

2. Privacy Violations

Knowing a vendor’s track record in maintaining its cybersecurity posture is essential to reduce its risk exposure. A good indicator of a vendor’s privacy health comes from the number of incidents resulting in a fine from a regulatory body or the number of data breaches experienced by the vendor. Little to no violations indicate a sound security posture score and rating. Any fines and breaches experienced by the vendor also indirectly harm the reputation of the business itself.

3. Respect for Consumers’ Data

A vendor’s ability to satisfy customer data requests for the data it collects and processes is a good indicator of its privacy program’s maturity. Assessing the vendor’s maturity in handling consumer DSR requests is essential for the vendor assessment exercise.

Responsible vendors incorporate privacy best practices into their design and development processes and offer tools and solutions to satisfy customer data requests within their SaaS products. These qualities are of significant operational value to the businesses and better vendor ratings.

To summarize, organizations must analyze all the aspects of their potential vendors concerning risk and security before choosing the right one. Organizations must assess the risks associated with their vendors before starting a relationship with them, as handling consumers’ personal data is a huge undertaking. This is a long, meticulous task that could seem inefficient and time-consuming. Organizations should implement PrivacyOps automation to make this process swift and productive with minimal error and complete compliance.