PRIV-07—PII Processing Agreements

>Control Description

Personal information is handled and processed in accordance with contractual requirements.

Theme

Process

Type

Preventive

Policy/Standard

>Implementation Guidance

1. Ensure that appropriate agreements are established to define PII processing requirements. 2. Ensure all customers sign PII processing agreements. 3. Ensure all PII is handled and processed as per contractual requirements.

>Testing Procedure

1. Inspect and validate that appropriate agreements are established and documented that define PII processing requirements. 2. For a sample customer validate that PII processing agreement has been signed. 3. Validate that all PII is handled and processed as per contractual requirements and the employees are briefed of these requirements.