A vendor-management programme signs data processing agreements then never reviews security posture, access rights, or DPA performance afterward. What does responsible GDPR-aligned vendor oversight require?
Select an answer to reveal the explanation.
Short Explanation
Signing the DPA is the wedding, not the marriage. You still need to check that the vendor keeps protecting personal data over time. One signature on day one is not lifelong autopilot.
Full Explanation
Vendor management is continuous and includes monitoring and reviews after contracting, not a one-time signature exercise. Programmes that sign DPAs then never review security posture, access rights, or DPA performance leave Article 28 sufficient-guarantees expectations unmanaged. Once a DPA is signed, duties are not permanently complete. Reviews are not required only if the vendor requests a marketing meeting. Controllers may not ignore processor performance until a fine is issued. Exam caveat: ongoing oversight is part of responsible controller use of processors. Operational check: schedule periodic assurance (questionnaires, SOC/ISO evidence review, access certifications, and right-to-audit triggers) scaled to the sensitivity of municipal personal data processed. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis. Confirm the analysis against the GDPR text and competent supervisory guidance before relying on it in production systems.