# Regulatory Standards — Vendor Privacy Due Diligence

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 28(1)**: "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject." This is the foundational obligation requiring due diligence before processor engagement.

- **Article 28(3)**: Processing by a processor shall be governed by a contract that sets out the subject-matter and duration of the processing, the nature and purpose, the type of personal data and categories of data subjects, and the obligations and rights of the controller. Due diligence findings feed directly into DPA negotiation.

- **Article 5(2)**: The accountability principle requires the controller to be able to demonstrate compliance. Due diligence documentation is a primary accountability artifact.

- **Article 24(1)**: The controller shall implement appropriate technical and organisational measures to ensure and demonstrate that processing is performed in accordance with the Regulation. Vendor assessment is part of this obligation.

- **Article 30(2)**: Processors must maintain records of processing activities. Due diligence should verify the processor maintains these records.

- **Article 32**: Security of processing. Both controllers and processors must implement appropriate technical and organisational measures. Due diligence verifies the processor's compliance with this article.

### EDPB Guidelines 07/2020 on Controller and Processor Concepts

Adopted 7 July 2021, these guidelines clarify:

- **Paragraph 85**: Controllers must assess whether a processor provides "sufficient guarantees" before engaging them. This requires an ex ante assessment.
- **Paragraph 86**: The assessment must consider the processor's expert knowledge, reliability, and resources. Certifications and adherence to codes of conduct may serve as indicators.
- **Paragraph 87**: The controller's assessment obligation is ongoing — not limited to initial engagement.
- **Paragraph 93**: Where the processor engages sub-processors, the controller's due diligence obligation extends to oversight of sub-processor arrangements.

### EDPB Recommendations 01/2020 on Supplementary Measures

When vendors process data outside the EEA, due diligence must include assessment of third-country legal frameworks per the Schrems II ruling (CJEU C-311/18). Transfer Impact Assessments should be incorporated into the due diligence process.

## Industry Standards Referenced in Assessment

### ISO/IEC 27001:2022

Information security management system certification. The current version (2022) includes updated controls in Annex A organized into four themes: Organizational, People, Physical, and Technological. Certification scope must cover the services provided to the controller.

### ISO/IEC 27701:2019

Privacy information management system extension to ISO 27001. Provides specific controls for PII processors (Annex B) and PII controllers (Annex A). Certification demonstrates a structured PIMS.

### SOC 2 Type II

AICPA Trust Services Criteria examination covering Security, Availability, Processing Integrity, Confidentiality, and Privacy. Type II reports cover a period (typically 12 months) and include auditor testing of control operating effectiveness. The Privacy criterion maps to GDPR requirements including consent, collection limitation, use/retention/disposal, access, disclosure, and quality.

### CSA STAR (Security, Trust, Assurance, and Risk)

Cloud Security Alliance STAR program with three levels:
- Level 1: Self-assessment against the Consensus Assessments Initiative Questionnaire (CAIQ)
- Level 2: Third-party audit against the Cloud Controls Matrix (CCM)
- Level 3: Continuous monitoring-based certification

## Supervisory Authority Guidance

### Bavarian DPA (BayLDA) — Processor Audit Guidelines

The BayLDA published practical guidance on processor audits in 2022, recommending:
- Risk-based audit frequency (annual for high-risk, biennial for standard)
- Combination of questionnaire, documentation review, and on-site audit
- Standardized finding classification (critical, major, minor, observation)

### Danish DPA (Datatilsynet) — Processor Due Diligence Guidance (2021)

Recommends that controllers:
- Maintain a processor register with risk classification
- Conduct initial assessment before contract execution
- Reassess at least annually or upon material changes
- Document the sufficiency assessment and decision rationale

### ICO (UK) — Contracts and Liabilities Between Controllers and Processors

The ICO guidance emphasizes that due diligence is the controller's responsibility and cannot be delegated to the processor. Controllers must take proactive steps to verify claims made by processors.