A municipality scores vendors only on lowest price and skips security questionnaires and contractual audit rights. Privacy asks for stronger vendor management. Which practice best supports responsible handling of personal data with processors?
Select an answer to reveal the explanation.
Short Explanation
Cheapest isn't safest when citizen data is on the table. Ask the hard security questions and write audit rights into the deal—like inspecting the locks before you hand over the keys. Price matters; it just isn't the whole vendor story under GDPR.
Full Explanation
Controllers remain responsible for choosing processors that provide sufficient guarantees of appropriate technical and organisational measures. Scoring municipal vendors only on lowest price while skipping security questionnaires and contractual audit rights undermines that duty. The practice that best supports responsible handling is risk-proportionate due diligence—including security questionnaires—and contractual audit and security rights matched to the sensitivity and volume of personal data.
Awarding every contract to the cheapest bidder on verbal “GDPR is fine” assurances confuses price with processor guarantees. Dropping audit clauses because authorities “never review” arrangements misstates supervisory reality and weakens enforceability. Treating price as the sole criterion precisely when personal-data volumes are high inverts risk logic.
Exam caveat: Article 28 “sufficient guarantees” is not satisfied by procurement savings alone. Operational check: embed security and privacy criteria in RFPs, score questionnaire responses, negotiate audit/inspection and TOM clauses, and reassess high-risk processors periodically. For city services, vendor diligence is a stewardship duty toward residents whose data leave the municipal perimeter.