Ongoing Monitoring of Third-Party Privacy Practices

Ongoing Monitoring of Third-Party Privacy Practices (CDPSE – Privacy Governance)

Overview
Ongoing monitoring of third-party privacy practices is the continuous oversight an organization keeps over vendors, processors, sub-processors, cloud providers, contractors and other partners that handle personal data on its behalf. Within the ISACA CDPSE (Certified Data Privacy Solutions Engineer) body of knowledge, this topic sits in the Privacy Governance domain. It connects to vendor and third-party risk management, data processing agreements, accountability and assurance.

The main idea is simple. You can outsource the processing, but you cannot outsource the accountability. The organization that decides why and how personal data is processed (the controller) stays responsible for how that data is protected, even when another party handles it.

Why It Is Important
1. Accountability stays with the controller. Regulations such as GDPR (Article 28), CCPA/CPRA, LGPD, PIPEDA and HIPAA (business associates) require controllers to use only processors that give sufficient guarantees. Controllers must also be able to show those guarantees still hold over time, not just at contract signing.
2. Risk changes over time. A vendor that was compliant at onboarding may later:
- change ownership
- move data to new countries
- add sub-processors
- suffer a breach
- reduce its security staff
- change its own data uses
A point-in-time assessment cannot catch these changes.
3. Breaches often come from third parties. Many major data breaches start with a vendor or supply-chain partner. Continuous monitoring shortens the time it takes to detect and respond.
4. Contractual obligations need verification. Data processing agreements (DPAs), standard contractual clauses (SCCs) and service level agreements only have value if someone checks that they are followed.
5. Protecting data subjects and trust. Individuals expect their data to be protected wherever it goes. Regulators, customers and boards expect proof of oversight.
6. Supporting data subject rights. Vendors must be able to support access, deletion, correction and portability requests within legal deadlines. Monitoring confirms they can.

What It Is
Ongoing monitoring is the post-contract phase of the third-party privacy risk management lifecycle. The full lifecycle is:
1. Planning and identification: determine the business need and what personal data will be shared.
2. Due diligence: assess the vendor's privacy and security posture before engaging them, using questionnaires, certifications, privacy impact assessments (PIAs/DPIAs) and transfer impact assessments.
3. Contracting: set out privacy requirements in a DPA. Typical clauses cover:
- purpose limitation
- confidentiality
- security measures
- sub-processor approval
- breach notification timelines
- audit rights
- assistance with data subject requests
- return or deletion of data at termination
4. Ongoing monitoring: continuously verify compliance and performance, and re-assess risk.
5. Termination and offboarding: make sure data is returned or securely destroyed, access is revoked and certificates of destruction are obtained.

Ongoing monitoring covers the periodic and event-driven activities that confirm the third party continues to meet privacy requirements over the life of the relationship.

How It Works
1. Third-party inventory and data mapping
Keep an up-to-date inventory of every third party that processes personal data. Record:
- the data categories involved
- processing purposes
- locations and cross-border transfers
- sub-processors
- the business owner
- the contract status
You cannot monitor what you do not know exists.

2. Risk-based tiering
Not every vendor needs the same level of scrutiny. Classify vendors as critical, high, medium or low risk based on:
- volume and sensitivity of data (for example, health, biometric, financial or children's data)
- criticality of the service
- level of access
- geographic risk
- regulatory exposure
Monitoring frequency and depth then follow the tier. For example, critical vendors might get an annual on-site or remote audit plus continuous monitoring, while low-risk vendors might get a periodic self-attestation.

3. Monitoring techniques
- Periodic reassessments: refreshed privacy and security questionnaires, such as SIG or CAIQ.
- Independent assurance reports: SOC 2 Type II (preferred over Type I because it tests operating effectiveness over a period), ISO/IEC 27001 and ISO/IEC 27701 certifications, and attestations.
- Audits: exercising contractual right-to-audit clauses through on-site or remote audits, or relying on third-party auditors.
- Continuous monitoring tools: security rating services, threat intelligence, dark web monitoring and news or adverse media monitoring.
- Performance metrics and KPIs/KRIs: for example, data subject request turnaround time, number of incidents, timeliness of breach notification, and patching and vulnerability metrics.
- Sub-processor change notifications: reviewing and approving or objecting to new sub-processors.
- Review of incident and breach reports: confirming the vendor met its contractual notification timelines and that remediation was adequate.
- Business reviews and governance meetings: regular meetings with vendor account managers and privacy officers.

4. Event-driven (triggered) reviews
Some events should trigger an out-of-cycle reassessment:
- a data breach or security incident at the vendor
- a merger, acquisition or change in ownership
- a change in the scope of services or data types
- new jurisdictions or cross-border transfers
- regulatory changes, such as the Schrems II invalidation of Privacy Shield
- negative media coverage or enforcement actions
- significant changes to the vendor's privacy policy

5. Issue management and remediation
When gaps are found:
- document them
- risk-rate them
- agree corrective action plans with owners and deadlines
- track them to closure
Escalate unresolved issues through governance channels. Options include accepting the risk (formally, by an authorized risk owner), mitigating it, transferring it (for example, through insurance or contract terms) or terminating the relationship.

6. Roles and responsibilities
- Business owner/relationship manager: owns the vendor relationship and day-to-day oversight.
- Privacy office/DPO: sets privacy requirements, reviews assessments and advises on risk.
- Information security: evaluates technical controls.
- Procurement/legal: manages contracts and remedies.
- Internal audit: provides independent assurance that the monitoring program itself works.
- Senior management/board: sets risk appetite and receives reporting.

7. Reporting and documentation
Keep evidence of monitoring activities, including:
- assessments
- reports reviewed
- issues logged
- approvals
- decisions
This supports accountability (demonstrating compliance) and gives regulators an audit trail. Report third-party privacy risk posture to governance committees on a regular basis.

8. Integration with the privacy program
Ongoing monitoring feeds into and draws from:
- the records of processing activities (RoPA)
- DPIAs
- incident response plans (vendor breach scenarios)
- data retention schedules
- privacy training
- the enterprise risk management (ERM) framework

Key Concepts and Terms to Know
- Controller vs. processor vs. sub-processor: the controller determines purposes and means. The processor acts on the controller's documented instructions. A sub-processor is engaged by the processor and usually needs the controller's prior authorization.
- Right to audit: the contractual clause that allows the organization to verify compliance.
- Flow-down clauses: require processors to impose equivalent obligations on their sub-processors.
- Fourth-party risk: the risk posed by your vendors' vendors.
- SOC 2 Type I vs. Type II: Type I covers the design of controls at a point in time. Type II covers both design and operating effectiveness over a period.
- Bridge letter (gap letter): covers the period between the end of a SOC report and the current date.
- Complementary user entity controls (CUECs): controls the customer must implement itself for the vendor's controls to be effective.
- Transfer impact assessment (TIA): evaluates the risks of cross-border transfers.

Exam Tips: Answering Questions on Ongoing Monitoring of Third-Party Privacy Practices
1. Remember who is accountable. If a question asks who is ultimately responsible for personal data processed by a vendor, the answer is almost always the organization (data controller), not the vendor. Be wary of options that shift accountability to the third party.

2. Choose risk-based approaches. ISACA strongly favors risk-based answers. If asked how often or how deeply to monitor vendors, choose the option that bases frequency and depth on the vendor's risk level, such as data sensitivity and criticality. Avoid one-size-fits-all options.

3. Know what comes first. Questions often test sequence:
- You need an inventory of third parties before you can monitor them.
- You need contractual rights (such as right to audit) before you can enforce assessments.
- You need defined requirements before you can measure compliance.
If an option says to first identify or classify vendors processing personal data, it is often correct for questions asking for the FIRST step.

4. Prefer independent, objective evidence. When asked for the BEST assurance, rank the options roughly as follows (strongest first):
1. independent audit or SOC 2 Type II and certifications such as ISO 27701
2. vendor self-assessment questionnaires
3. verbal assurances or marketing claims
On-site audits by the organization give high assurance but are resource-intensive. Choose them for critical vendors or after a significant incident.

5. Point-in-time vs. continuous. If an option relies only on due diligence at onboarding, it is usually wrong when the question is about ongoing oversight. Look for answers involving periodic reassessment and trigger-based reviews.

6. Recognize trigger events. A breach at the vendor, an acquisition, a new sub-processor, a change in data location or a new regulation should all prompt a reassessment. If a scenario describes one of these events, the best answer often involves reassessing the vendor's privacy risk or reviewing the contract and DPIA.

7. Distinguish the BEST response to a finding. When a vendor is found non-compliant, the immediate answer is usually not to terminate the contract. ISACA generally prefers to:
1. assess the impact and risk
2. communicate with the vendor and require a corrective action plan
3. track remediation
4. escalate, or consider termination, if the issue is not resolved or the risk exceeds risk appetite
Termination is the right answer only when the scenario shows severe, unremediated or repeated violations.

8. Watch for sub-processor and fourth-party issues. Correct answers usually involve:
- requiring prior authorization or notification of sub-processors
- flow-down of equivalent obligations
- holding the primary processor accountable for its sub-processors

9. Contract clauses enable monitoring. If a question asks what MOST effectively enables ongoing monitoring, the answer is often a right-to-audit clause or specific reporting obligations in the DPA. Breach notification timelines, assistance with data subject requests and return or deletion of data are also key clauses.

10. Read SOC report questions carefully.
- If a SOC report period ended months ago, look for a bridge letter.
- If the report lists exceptions, evaluate whether they affect privacy controls relevant to your data.
- Remember that you must implement the CUECs yourself.
- A SOC report that does not cover the relevant system or service is insufficient.

11. Roles matter. The privacy function sets requirements and advises. The business owner manages the relationship. Internal audit provides independent assurance of the monitoring process. Senior management accepts residual risk. Be careful with options that give risk acceptance to someone without the authority.

12. Documentation equals demonstrable accountability. Answers that emphasize keeping evidence of monitoring are often favored, especially in questions about regulator inquiries or showing compliance. Examples include assessment results, issue logs and approvals.

13. Look for keywords. Words such as FIRST, BEST, MOST important, PRIMARY and GREATEST risk change the answer. For example:
- The GREATEST risk is often a vendor processing personal data without a contract or DPA, or without the organization's knowledge.
- The PRIMARY purpose of ongoing monitoring is to ensure continued compliance with contractual and regulatory privacy obligations and to manage privacy risk.

14. Think like a privacy engineer and a governance leader. CDPSE is technical, but governance questions reward answers that are:
- systematic and repeatable (a defined program)
- aligned with policy and risk appetite
- integrated with the wider privacy and ERM frameworks
Ad hoc or reactive approaches are usually wrong.

Sample Question Walkthrough
An organization learns that a cloud service provider processing customer personal data has been acquired by a company headquartered in another jurisdiction. What should the privacy engineer do FIRST?
A. Terminate the contract immediately
B. Reassess the provider's privacy risk, including data location and transfer implications
C. Notify all data subjects
D. Wait for the next annual review

Correct answer: B. An acquisition is a trigger event, so it calls for an out-of-cycle reassessment.
- Termination (A) is premature before the risk is assessed.
- Notifying data subjects (C) is not required, because there is no breach.
- Waiting (D) ignores event-driven monitoring.

Summary
Ongoing monitoring of third-party privacy practices makes sure that privacy protections agreed at onboarding keep working throughout the vendor relationship. It relies on:
- a complete vendor inventory
- risk-based tiering
- contractual rights such as audit rights and breach notification
- independent assurance
- trigger-based reassessments
- structured remediation
- clear documentation
For the exam, remember that accountability stays with the organization, approaches should be risk-based and continuous, independent evidence beats self-attestation, and findings should lead to remediation and escalation rather than automatic termination.