Manage vendors and sign DPAs

Manage Vendors and Sign DPAs

Every third-party service that processes personal data on your behalf is a “processor” under GDPR and CPRA. To stay compliant, companies must assess vendor risks and sign Data Processing Agreements (DPAs) that hold vendors accountable to the same standards.

Identifying Vendors

Map all tools and services that touch user data.

• Cloud hosting (AWS, GCP, Azure).

• Analytics and marketing platforms.

• Payment processors and email services.

• Customer support and CRM tools.

Key Elements of a DPA

DPAs formalize responsibilities between you (controller) and the vendor (processor). They typically include:

• Clear instructions on how data may be processed.

• Security obligations and breach notification timelines.

• Sub-processor approval and oversight requirements.

• Support for data subject rights requests.

• Terms for data deletion upon contract end.

Vendor Risk Assessments

Evaluate vendors before onboarding.

• Check their compliance certifications (ISO 27001, SOC 2, GDPR, CPRA).

• Review privacy policies and security documentation.

• Conduct technical due diligence where high-risk data is involved.

Example: Using a CRM Vendor

When adopting a CRM system:

• Sign the vendor’s DPA or negotiate terms.

• Confirm the vendor encrypts data at rest and in transit.

• Require a clear deletion process when accounts are closed.

• Document the assessment in your compliance log.

Implementing Vendor Controls in Practice

Automated vendor tracking

CREATE TABLE vendor_registry (
  id SERIAL PRIMARY KEY,
  name TEXT NOT NULL,
  processes_personal_data BOOLEAN,
  dpa_signed BOOLEAN,
  last_audit DATE
);

Checklist snippet for vendor onboarding

vendor_onboarding:
  - Verify security certifications
  - Review privacy policy
  - Sign DPA
  - Document data flows
  - Schedule annual review

Example audit reminder

# Cron to send quarterly vendor audit reminders
0 9 1 */3 * ./send_vendor_audit_reminder.sh

Conclusion

By actively managing vendors and locking agreements into DPAs, companies extend compliance obligations beyond their own systems, ensuring third parties safeguard data with the same rigor.