Build Supply Chain Confidence.
Most modern business operations involve frequent exchanges of personal data with third parties. Data is shared with cloud services, customer relationship management systems, consultants, exported human resources functions, marketing agencies and more. It is crucial that organisations protect personal data at all stages within these supply chains. Tacita’s Vendor Risk Management service manages this for you.
- Audit your third parties for GDPR compliance
- Understand risks to your business
- Resolve those risks with actionable solutions
- Managed by Tacita
Reduce the risk to your organisation
Send a message to one of our team and we will help you to build confidence in your supply chain.
How does it work?
Tacita will conduct audits of your third parties to assess the third-party GDPR risk to your business.
- Identify & Select Third Parties - Identify and select the third parties who you would like to audit.
- Provide Contact Details - Provide the contact details so that Tacita can issue the audit.
- Audit is Issued - Tacita will issue the audit to your third parties with a covering note explaining all relevant information.
- Automated Reminders - Tacita will send automated reminders leading up to the deadline which you have chosen.
- Results are Processed - Tacita will process the results for you and generate a dashboard of third party risk.
- Remedy Issues - Tacita can work with selected third parties to remedy any issues that are found.
Getting started is quick & easy
Vendor Risk Management FAQs
Tacita can audit any third parties who are defined under the GDPR as either your ‘Processors’ or ‘Sub-Processors’. For a typical business, this would include most of the third parties who you transfer personal data to.
Under the GDPR, it is a legal requirement that when there is a transfer of personal data between a data controller and a data processor, that there is a contract in place. This contract must have a clause that allows the data controller to audit data processors to check for GDPR compliance. Similar requirements exist for processor to sub-processor contracts.
Unfortunately, there is no legal requirement to have this clause in place for joint controller relationships, but some third parties who are classed as joint controllers may still be happy to comply with a reasonable GDPR audit request.
Data Processors or Sub-Processors are required to comply with reasonable requests for GDPR audits from their Data Controller. Processors or Sub-Processors who refuse audit requests would be in breach of contract.
Tacita asks a selection of 35 questions that cover basic GDPR management practices. These questions include the following topics: GDPR governance, training and awareness, policies, procedures, and third party transfers.
These questions are not onerous; the majority are multiple choice. An organisation with competent GDPR management should be able to answer them within 20 minutes.
Please reach out to us if you would like to see a copy of the questions.
Tacita will produce a dashboard of results. The dashboard will contain a colour coded summary of all organisations along with a breakdown of individual third parties. We will include an average score for all organisations and will indicate any third parties that are considered a risk.
Tacita recommends taking a risk management approach to issues that are found. Not all issues are equal and not all need to be resolved.
Take the example of a marketing consultant who has been given read-only access to parts of your marketing database. They provide advice and guidance for your marketing team. You may deem that the nature and scope of the data which this marketer has access to is low risk and that you have sufficient protections in place already. As such, remedial actions may not be needed.
Conversely, if you are sending children’s medical data to a third party who has scored low in Tacita’s audit, this is likely to be a high priority to remedy.
Yes. Tacita can work directly with your third parties to remedy issues that are found. We have ready to go solutions for the most common GDPR management issues that are identified.