Third-Party Risk, Vendor Management, and Cross-Border Transfers
What this domain tests
This domain tests vendor governance from due diligence through contract, monitoring and exit, plus the Chapter V transfer toolkit. Questions often present a transfer scenario and ask which mechanism is valid, or present a vendor claim and ask what evidence is missing.
Core rules
- Art 28 contract. Written terms covering processing on instructions, confidentiality, security, sub-processor authorisation, assistance with data subject rights and DPIAs, breach notification, deletion or return at the end, and audit rights.
- Risk-tiered due diligence. Tier by data sensitivity, volume, system access and criticality. Pre-contract questionnaires, certifications and independent reports are inputs, not proof of control effectiveness. Ongoing monitoring includes reassessment on change.
- Supply chain. Map sub-processors and onward transfers, require notification of changes with an objection right, and track concentration risk and exit/transition plans.
- Chapter V transfers. Adequacy decisions; Standard Contractual Clauses (2021 modules) with a transfer impact assessment following Schrems II; Binding Corporate Rules for intragroup transfers; Art 49 derogations reserved for occasional, non-repetitive transfers.
- Supplementary measures. Encryption with keys retained in the EEA, pseudonymisation, split or localised processing, and transparency about government access requests.
- Other regimes. PIPL requires a CAC security assessment, certification or standard contract for outbound transfers; some jurisdictions mandate localisation.
Worked example
An EU controller moves support to a vendor whose sub-processor is in India. Steps: sign an Art 28 DPA, confirm sub-processor authorisation and change notice, execute SCC Module 2, run a transfer impact assessment covering Indian surveillance law, add supplementary encryption with EEA-held keys, update the RoPA, and record an exit plan. Reasoning: contract, then transfer mechanism, then supplementary measures, then documentation.
Traps that cost marks
Treating adequacy, SCCs and Art 49 derogations as interchangeable; assuming certification equals compliance; forgetting onward transfers to sub-processors; relying on the consent derogation for routine, repetitive transfers; accepting a vendor's self-declared compliance as due diligence.