Due diligence, DPA agreements, and ongoing assessments under GDPR, NIS2, and DORA
Third-party risk management per GDPR (Art. 28), NIS2 (supply chain security), and DORA (ICT third parties). Due diligence, data processing agreements, and continuous assessments.
Assessment of supplier security and compliance capabilities, questionnaires, on-site audits, certification review, and risk scoring.
Drafting and review of DPA contracts with processors per GDPR Art. 28, defining security measures and reporting obligations.
Assessment of supplier technical and organizational measures, penetration testing, vulnerability scanning, and compliance certification review.
Periodic supplier reviews, incident tracking, certification renewal tracking, and re-assessment upon changes.
Procedures for supplier incidents, communication protocols, response SLAs, and coordination with your incident response plan.
Processor agreement
DPA, security measures, sub-processor approval, audit rights
Supply chain security
Vendor risk assessment, security controls, incident reporting
ICT third parties for financial institutions
Due diligence, continuous monitoring, exit strategies, regulatory register
Mapping all suppliers processing data or providing critical services.
Supplier classification by risk (critical, high, medium, low).
Security and compliance assessment for high-risk suppliers.
DPA agreements and security requirements in contracts.
Continuous tracking and periodic reviews.
A Data Processing Agreement (DPA) is a contract between the controller and processor under GDPR Art. 28. It's mandatory for all suppliers processing personal data on your behalf (e.g., cloud hosting, payroll, CRM).
Risk depends on the type of data they process, service criticality, access to your systems, and their security measures. Critical suppliers require detailed due diligence and audits.
DORA (Digital Operational Resilience Act) sets strict requirements for financial institutions: pre-contract due diligence, continuous monitoring, exit strategies, register of critical ICT suppliers, and regulator reporting.
GDPR doesn't specify exact timelines, but best practice is annual review for critical suppliers, every 2-3 years for less critical ones. DORA requires continuous monitoring of critical ICT suppliers.
Typical outcomes: vendor inventory, risk scoring, DPAs ready, critical supplier assessments.
Schedule Consultation