undefined | Better HN

0 pointspbhjpbhj8y ago0 comments

>How do I know if a vendor is compliant? //

Did they ask for explicit permission to use your data? Do they provide the service if you only provide the data they actually need, rather than asking for a swathe of PII so they can sell it on? Do they provide info on how your data is stored, and who has access to it? Do they provide a way for you to view and/or delete all the PII they have on you?

0 comments

1 comments · 1 top-level

Kalium8y ago

You're right! Those are all critically important questions to ask! It's just possible that they might not be completely exhaustive, though.

Do they take reasonable measures to detect and inform me of a breach? Do they take reasonable measures to ensure it's me requesting data being deleted? Can they provide the same data about all Data Processors they make use of?

It's possible that the answers to this might not be easily and readily answered in every single potential case one might encounter when dealing with specialist vendors.

You're completely right to spell out those questions. It's just possible that there may be more to GDPR compliance - and certainty - than that in some cases.

j / k navigate · click thread line to collapse