P6.5 Obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to
Obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications a.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the notification channel and the timeframe committed to · Data governance / DLP tooling
- Records of notifications actually received during the period and the date each arrived · Data governance / DLP tooling
- Evidence received notifications are reported to the personnel responsible for privacy incident handling · Data governance / DLP tooling
- Escalation evidence where a third party notified late or not at all · Vendor register / contract repository
governing documentDocuments that govern the control
- Contractual commitments from vendors and third parties requiring notification of actual or suspected unauthorised disclosure · Vendor register / contract repository
First move
Common gaps auditors find
- Notification clause requires disclosure without a timeframe, so late notification breaches nothing
- Notifications arrive to a commercial or account contact and never reach privacy or incident response
- Suspected disclosure excluded from the clause, so a third party waits until an event is confirmed before telling anyone
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed · P6.6 Provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy