A municipality scores vendors only on lowest price and skips security questionnaires and contractual audit rights. Privacy asks for stronger vendor management. Which practice best supports responsible handling of personal data with processors?
Select an answer to reveal the explanation.
Short Explanation
Cheapest isn't safest when citizen data is on the table. Ask the hard security questions and write audit rights into the deal—like inspecting the locks before you hand over the keys. Price matters; it just isn't the whole vendor story under GDPR.
Full Explanation
Controllers remain responsible for ensuring processors provide sufficient guarantees of appropriate technical and organisational measures. Practical vendor management therefore includes risk-proportionate due diligence, security questionnaires, and contractual rights to audit or obtain assurance—not price-only selection or reliance on informal assurances.