A vendor-management playbook relies only on a security schedule and skips data-processing agreements because 'security covers GDPR.' What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
A security appendix is great armor, but it isn't the whole GDPR contract kit. You still need proper processor terms—roles, instructions, sub-processors, assistance duties—not just a lock icon on a schedule. Security and processing clauses work as a pair.
Full Explanation
Security schedules and technical annexes help demonstrate Article 32 themes, but they do not replace required processor contractual terms under Article 28 or clear documentation of controller–processor roles. A vendor-management playbook that skips data-processing agreements because “security covers GDPR” leaves instructions, confidentiality, sub-processing rules, assistance with rights and breaches, and end-of-contract return or deletion under-specified.
Security schedules do not replace Article 28 terms by operation of law. Verbal NDAs alone fail the documentation and mandatory-content expectations for processor arrangements. ISO 27001 certification may support confidence in security management yet does not make data-processing agreements optional.
Exam caveat: security packaging ≠ complete GDPR processor compliance kit. Operational check: execute Article 28 agreements covering documented instructions, TOMs, sub-processor authorisation, assistance duties, audit rights, and deletion/return; keep security schedules as complementary annexes. Cities should refuse to hand citizen data to vendors on security slides alone and should record that price-plus-ISO without processor terms was rejected as insufficient stewardship.