# Vendor Processing PIA — Standards and Legal References

## Primary Legislation

- **GDPR Article 28** — Processor obligations; mandatory DPA requirements; sub-processor management; controller right to audit.
- **GDPR Article 26** — Joint controller arrangements; applicable when vendor relationship involves joint determination of purposes and means.
- **GDPR Article 32** — Security of processing; controller and processor must implement appropriate technical and organisational measures.
- **GDPR Article 44-49** — International transfers; applicable when vendor is located outside the EEA.
- **GDPR Article 82** — Right to compensation; controller and processor liability for damage caused by processing.

## Regulatory Guidance

- **EDPB Guidelines 07/2020 on Controller and Processor Concepts** — Clarifies the distinction between controller, processor, and joint controller roles in vendor relationships.
- **EDPB Recommendations 01/2020 on Supplementary Measures for International Transfers** — Guidance on assessing third-country vendor adequacy and implementing supplementary measures.
- **ICO Guide to GDPR: Controllers and Processors** — Practical guidance on controller-processor relationships and DPA requirements.
- **Dutch DPA Cloud Services Assessment Framework (2022)** — Detailed methodology for assessing cloud vendor privacy compliance.
- **CNIL Practical Guide on Sub-processors** — Guidance on managing sub-processor chains and notification obligations.

## Case Law

- **CJEU Wirtschaftsakademie (C-210/16, 2018)** — Fan page administrator as joint controller; vendor platform use does not absolve controller responsibility.
- **CJEU Fashion ID (C-40/17, 2019)** — Website operator as joint controller for embedded vendor components (Facebook Like button).
- **CJEU Schrems II (C-311/18, 2020)** — Invalidation of Privacy Shield; requirement for transfer impact assessment when using US-based vendors.

## Industry Standards

- **ISO/IEC 27001:2022** — Information security management; vendor security certification baseline.
- **ISO/IEC 27701:2019** — Privacy information management; processor-specific controls in Annex B.
- **SOC 2 Type II** — AICPA Trust Services Criteria; common vendor security assurance report.
- **CSA STAR** — Cloud Security Alliance Security, Trust, Assurance, and Risk; cloud vendor security assessment.
- **ISO 28000:2022** — Security management systems for the supply chain; applicable to vendor risk management.
- **NIST SP 800-171 Rev. 3** — Protecting Controlled Unclassified Information in non-federal systems; applicable to US vendor assessments.
- **NIST Cybersecurity Framework v2.0 GV.SC** — Supply chain risk management category; vendor cybersecurity assessment.