Infrastructure security (12)
PII transmission controls for processor
The company encrypts PII in transit.
PII transmission controls for controller
The company implements technical controls to ensure data transmitted to third parties reaches its destination.
Data encryption utilized
The company's datastores housing sensitive customer data are encrypted at rest.
Remote access encrypted enforced
The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
Data transmission encrypted
The company uses secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks.
Remote access MFA enforced
The company's production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.
Production network access restricted
The company restricts privileged access to the production network to authorized users with a business need.
Unique network system authentication enforced
The company requires authentication to the "production network" to use unique usernames and passwords or authorized Secure Socket Shell (SSH) keys.
Unique account authentication enforced
The company requires authentication to systems and applications to use unique username and password or authorized Secure Socket Shell (SSH) keys.
Network firewalls utilized
The company uses firewalls and configures them to prevent unauthorized access.
Network segmentation implemented
The company's network is segmented to prevent unauthorized access to customer data.
Network firewalls reviewed
The company reviews its firewall rulesets at least annually. Required changes are tracked to completion.
Organizational security (6)
Countries and international organizations to which PII can be stored for processor
The company documents all countries where PII is stored.
Countries and international organizations to which PII can be transferred for controller
The company specifies and documents the countries and international organizations where PII is transferred.
Records of transfer of PII
The company documents transfers of PII to or from third parties and ensures cooperation with the requests from data subjects.
Data inventory
The company creates and maintains a PII data inventory.
Access revoked upon termination
The company completes termination checklists to ensure that access is revoked for terminated employees within SLAs.
MDM system utilized
The company has a mobile device management (MDM) system in place to centrally manage mobile devices supporting the service.
Internal security procedures (20)
Continuity and Disaster Recovery plans established
The company has Business Continuity and Disaster Recovery Plans in place that outline communication plans in order to maintain information security continuity in the event of the unavailability of key personnel.
Continuity and Disaster Recovery plans tested annually
The company has a documented Business Continuity/Disaster Recovery (BC/DR) plan and tests it annually.
Identify lawful basis
The company documents the lawful basis for PII processing.
Limit collection
The company limits collection of PII to the minimum that is necessary for its purposes.
PII minimization
The company ensures that it only collects and processes data which it needs for its purposes.
Appoint EU representative
The company shall appoint an EU based representative.
Appoint EU lead supervisory authority
If the company is operating in more than one EU state then identify a lead Data Protection Authority.
Customer data deleted upon leave
The company purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.
Required Contribution for Binding Arbitration Mechanism
The company contributes to the ICDR-AAA arbitral fund required by Annex I of the EU-U.S. Data Privacy Framework (DPF) Principles.
Annual Verification of DPF Compliance
The company verifies at least once a year, by self-assessment or outside compliance review, that its EU-U.S. DPF privacy attestations are true and implemented as represented.
Designate a DPF Contact
Designate an internal contact for questions or compliance related to the DPF and communicate that information in the company's Privacy Notice.
Internal Privacy Policy
Implement an Internal Privacy Policy which governs the use of personal information for employees, applicants, and contractors.
Accuracy and quality
The company has a process to ensure that PII is complete, accurate, and up-to-date.
Appoint Data Protection Officer
The company appoints a Data Protection Officer where its processing activities require one.
DPF-Compliant Privacy Policy Statement
The company's Privacy Notice includes the elements required by the EU-U.S. Data Privacy Framework.
Incident response policies established
The company has security and privacy incident response policies and procedures that are documented and communicated to authorized users.
Assist controllers with privacy obligations
The company's Data Processing Agreements (DPA) with the customers (controllers) commit to assisting them with privacy obligations.
Basis for PII transfer between jurisdictions
The company's Master Services Agreement (MSA) informs the customer of the legal basis for transfers between jurisdictions and allows customers to object to changes or terminate service.
Sub-processor changes
The company communicates the changes to sub-processors to the customer in writing with the opportunity to object.
Contracts with PII processors
The company implements a written contract with all PII processors, which includes their requirements.
Data and privacy (23)
Access, correction and/or erasure
Defined process and procedure for data subjects to access and correct their PII.
Handling DSAR requests
Define and document procedures for handling Data Subject Access Requests (DSAR).
Identify basis for PII transfer between jurisdictions
The company identifies and documents its legal basis for transferring between jurisdictions.
Asset disposal procedures utilized
The company has electronic media containing confidential information purged or destroyed in accordance with best practices, and certificates of destruction are issued for each device destroyed.
Process as per processor agreements
The company only processes PII for the purposes expressed in contract (SCCs 8.1 and 8.2).
Marketing and advertising use
The company does not use the PII collected for services for marketing and advertising without consent. Consent for marketing is not required for using services.
Infringing instruction
The company informs the customer if processing instructions are illegal. (SCC 8.1(b))
Customer obligations
The company provides their customer with information sufficient for them to demonstrate their privacy compliance. (SCC 8.9(b))
Records related to processing PII
The company maintains necessary privacy records.
Notification of PII disclosure requests
The company communicates legally binding disclosures for PII to the customer before disclosure where possible. (SCC 15.1-2)
Legally binding PII disclosures
The company rejects any non-binding PII disclosures. (SCC 15.2)
Disclosure of subcontractors used to process PII
The company discloses all PII sub processors to the customer.
Identity and document purpose
The company documents the purpose for which PII is processed.
Consent obtained
The company determines and documents when and how consent was obtained.
PII data subject notice
The company determines and documents requirements for notice to data subjects and the timing of the notice.
PII data subject information
The company provides data subjects clear and easily accessible information identifying the controller and describing the PII processing.
Modify or withdraw consent
The company provides a mechanism to modify or withdraw consent.
Object to PII processing
The company provides a mechanism for data subjects to object to processing.
PII controllers' obligations to inform third parties
Establish a process, policies and procedures for notifying sub processors of corrections, deletions or withdrawals of PII.
Copy of PII processed
Establish a process of providing a copy of PII to data subjects upon verified request.
Records of PII disclosure to third parties
The company should record disclosure of PII to third parties including what has been disclosed and what time.
Independent Recourse Mechanism
The company shall make readily available an independent recourse mechanism by which each individual's complaints and disputes are investigated and expeditiously resolved at no cost to the individual.
DPF Certification
The company self-certifies its participation in the EU-U.S. Data Privacy Framework with the U.S. Department of Commerce.