Which questions should we ask a security vendor about its sub-processors?
Ask who they are, what each one does with your data, where it does it, and how you will hear about changes. A sub-processor is a company the vendor uses to process your personal data, such as a hosting provider, a database service or an e-mail delivery service. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., a processor may engage one only with the controller’s prior authorisation, specific or general, and must flow the same data protection obligations down to it. Practical questions: Is the full list published, with location and purpose for each entry? How much notice do you get before a new one is added, and can you object? Which of them can see readable data, and which only hold encrypted data? Are any outside the EU, and on which transfer basis? Who is liable if a sub-processor fails? NetSenX lists its sub-processors in its data processing agreement, published on the website, so you can check them before you sign up.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does a network monitoring service need a data processing agreement?
- Is the NetSenX data processing agreement public, and what does it commit to?
- Where does NetSenX store data about our employees’ devices, and for how long?
- Do we need a data protection impact assessment before deploying network monitoring?
- Is a smaller European security vendor a business continuity risk?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).