7.3.7 PII controllers' obligations to inform third parties
The organization must inform third parties with whom personal data has been shared of any modification, withdrawal or objection affecting that data and must implement policies, procedures or mechanisms to do so, taking a
4
artefacts
0
held by a system
2
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Notification records with acknowledgements of receipt · HR system / LMS
- Evidence channels are tested and kept live rather than assumed · Document repository
governing documentDocuments that govern the control
- Register of third parties who have received personal data, per processing activity · Vendor register / contract repository
- Documented notification mechanism per third party with a named owner · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Third parties recorded at the point of sharing and never maintained, so the register is stale when it is needed
- Notifications sent with no acknowledgement tracked, so nobody knows whether they landed
- Channel is a named individual's email address, which fails when that person leaves
- Only consent withdrawals propagated, with corrections and objections left behind
- Historic recipients from before the register existed never brought into scope
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.3.6 Access, correction and/or erasure · 7.3.8 Providing copy of PII processed