Privacy and compliance · 20 answer guides
How to answer privacy questions in a security questionnaire
GDPR and CCPA rights, consent, DPOs, HIPAA, PCI, and the compliance programs behind them. These answers often end up in the DPA, so they need to be exact.
Data subject access requests
How do you handle data subject access requests (DSAR)?Data deletion requests
Describe your process for data deletion/right to be forgotten.International data transfers
How do you handle international data transfers?Data Protection Officer (DPO)
Have you appointed a Data Protection Officer (DPO)?Data protection impact assessments
Do you conduct data protection impact assessments (DPIAs) when processing personal data?Privacy by design and default
Are systems configured privacy-by-default, in line with applicable laws and regulations?Consent management
How do you obtain and manage consent?Privacy notices
What privacy notices do you provide?Secondary use of customer data
Do you claim rights to use customer data for your own purposes?Selling customer data
Do you sell customer data to third parties?Business Associate Agreements (BAA)
Do you sign Business Associate Agreements (BAAs) with customers?PHI safeguards
How do you ensure PHI confidentiality, integrity, and availability?Minimum necessary access to PHI
How do you handle minimum necessary access to PHI?HIPAA authorizations
Describe your process for HIPAA authorizations.Cardholder data protection
How do you protect cardholder data?Payment card data retention
How do you limit data retention for payment card information?ISMS maintenance
How do you maintain your ISMS (Information Security Management System)?Security management review
Describe your management review process.Control environment
Describe your control environment.Trust services criteria
How do you define and monitor trust service criteria?