SCENARIO Please use the following to answer the next QUESTIO N: Penny has recently joined Ace Space, a company that sells homeware accessories…

From a privacy perspective, the review of a vendor contract must ensure compliance with legal and regulatory obligations. This involves defining the scope of data access, establishing liability for breaches, and securing audit rights to verify compliance. These elements are core to data protection. While the adequacy of security protections is critical, the specific pricing for these protections is a commercial or financial term. The privacy officer's primary concern is whether the security measures are sufficient to meet legal requirements (e.g., GDPR Article 32), not the specific cost negotiated for them. Therefore, pricing is the least crucial element for the privacy review itself.

A. Audit rights are crucial for a controller to verify a processor's compliance with data protection obligations, as mandated by regulations like GDPR Article 28.

B. Liability for a data breach is a critical contractual term that allocates risk and responsibility, ensuring clarity on duties and financial obligations following an incident.

D. The data a vendor will have access to is fundamental. This defines the scope of processing and is essential for upholding the principle of data minimization.

1. IAPP. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.).

Chapter 6: The Privacy Operational Life Cycle: Protect: This chapter details vendor management. It emphasizes that contracts must "specify the purpose of the processing

the types of personal information to be processed

the categories of data subjects

and the controller’s obligations and rights" and include "provisions for audits and inspections." It also discusses allocating liability. Pricing is treated as a commercial negotiation

whereas the other elements are presented as essential privacy and compliance requirements. (pp. 208-212).

2. General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679.

Article 28(3): This article lists the mandatory elements that must be included in a contract between a controller and a processor. It explicitly requires clauses on the subject matter and duration of the processing (related to option D)

the processor's obligations to assist the controller

and making information available for audits (option A). It also forms the basis for assigning responsibility (related to option B). It does not mention pricing for security measures.

3. Smedinghoff

T. J. (2016). Chapter 10 - Contracting for data and data services. In Information Security Law and Privacy. Artech House.

This academic text on information security law discusses key contractual provisions for data processing. It highlights the importance of defining the scope of data access

security obligations

audit rights

and allocation of liability as essential legal and risk management components. Commercial terms like pricing are discussed separately from these core compliance and security provisions. (Section 10.4: Key Contractual Provisions).