Vendor risk: why your suppliers’ security is part of your compliance

Your business answers for the personal information it holds, and that includes information a vendor handles for you. A payroll provider, a cloud host or an artificial intelligence (AI) writing tool can each process customer data on your behalf. When a vendor has a security gap, that gap becomes part of your compliance work.

What vendor risk means

Vendor risk is the chance that a supplier mishandles the data you give it. Think of a contractor who has a key to your office. The contractor works inside your building, but the building and what is in it stay your responsibility. Your vendors work the same way: they handle the data, but you remain answerable for it.

Why it matters for a small business

Law 25 applies to every business that holds personal information about people in Québec. It requires you to name one person in charge of protecting that information. PIPEDA, the federal privacy law for private businesses, lists accountability as one of its ten fair information principles. Under both laws, you stay accountable for personal information that a vendor processes for you.

The exposure is large. Law 25 sets administrative monetary penalties of up to $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater. People can also sue for damages, and punitive damages can apply to intentional or grossly negligent breaches.

Your clients also ask questions. SOC 2 is common in North American business-to-business (B2B) sales, and a client may ask for it before a contract. ISO/IEC 27001 is the international standard for an information security management system (ISMS). If your vendors cannot show their own controls, you may struggle to answer those questions. Clients may also ask which vendors hold their data.

If you offer goods or services to people in the EU, or monitor their behaviour, the EU General Data Protection Regulation (GDPR) applies too. Its fines can reach €20 million or 4% of worldwide annual turnover.

Treat a vendor incident as your own. If a vendor tells you about a breach that touches your customers’ data, record it in your incident register. Law 25 requires a register of confidentiality incidents, whatever their severity. If the breach presents a risk of serious injury, notify the Commission d’accès à l’information (CAI) and the people concerned promptly.

How to approach it

Work through these steps once, then keep them on a schedule.

1. Build the vendor list. Start from your software inventory. Add the tools that staff use without telling IT. These tools, often called shadow IT, can hold personal information too.
2. Tier each vendor by the data it touches. A high tier holds sensitive personal information or large volumes of customer or employee data. A medium tier holds contact details only. A low tier touches no personal information.
3. Ask high-tier vendors for evidence. Use the questions below, and file each answer with the contract.
4. Sign a data processing agreement (DPA) with every vendor that handles personal information for you.
5. Complete a privacy impact assessment (PIA) before data leaves Québec, and before you add a system that handles personal information.
6. Review each vendor on a fixed rhythm. Review high-tier vendors once a year. Review any vendor when its contract renews, when it adds a subprocessor, or when the data it holds changes.

What a data processing agreement covers

A DPA is a written contract between you and a vendor that handles personal information for you. It sets the rules the vendor must follow. A useful DPA covers:

• The purpose: what the vendor may do with the data, and nothing more.
• The kinds of personal information and the people concerned.
• The security measures the vendor uses, such as access control and encryption.
• Where the data is stored and processed.
• The subprocessors the vendor uses, and notice before it adds one.
• How and when the vendor tells you about a breach.
• How the vendor deletes or returns your data at the end of the contract.

What to ask a vendor

Ask these questions before you sign, and again at each review:

• Can you share your latest SOC 2 report or ISO/IEC 27001 certificate?
• Where is our data stored and processed?
• How and when will you tell us about a breach that affects our data?
• Which subprocessors can access our data?
• What happens to our data at the end of the contract, and how is it deleted?

A SOC 2 Type I report checks the design of controls at one point in time. A SOC 2 Type II report tests that the controls worked over a period, often 3 to 12 months. An ISO/IEC 27001 certificate comes from an accredited body and covers an information security management system.

Assess before data leaves Québec

Law 25 requires a privacy impact assessment (EFVP, évaluation des facteurs relatifs à la vie privée) before you share personal information outside Québec. The same assessment applies to projects that acquire, develop or overhaul an information system or electronic service that involves personal information. A vendor that receives your data outside Québec falls under this rule. Keep the assessment, the decision and the date with the contract.

Common mistakes

• Accepting a marketing page as proof. Ask for the report itself.
• Signing the vendor’s standard terms without reading the data clauses.
• Assuming a report covers every service the vendor sells. Read the scope of the report.
• Forgetting the tools that staff adopt on their own.
• Keeping a former vendor’s data after you stop using it.
• Running the assessment once and never again.
• Treating a vendor breach as someone else’s problem.

How NextIT helps

NextIT brings your vendors into one place. The software inventory lists each tool with its cost, and the Vendors module keeps your supplier records. In Privacy & Compliance, you track data processing agreements, run privacy impact assessments and keep your ROPA register, which is your record of processing activities. The Privacy & Compliance guide explains each part. To see how this fits your business, book a demo.