SURF Vendor Compliance
Together we ensure the best privacy and security terms for education and research
What is Vendor Compliance?
When personal data is breached, institutions face the risk of fines, reputational damage and liability claims. It is therefore necessary to check with suppliers how they process your data. Clear agreements must be made about this. Institutions often perform this compliance work individually: the same work for the same applications while expertise is scarce and expensive. To support institutions in these processes and take work off their hands, SURF Vendor Compliance carries out various compliance processes each year. Each year an average of eight projects are picked up. We determine which projects these are together with the members.
Latest news
DPIA on Nextcloud Enterprise software: 15 low or solved risks
SURF and Privacy Company have jointly conducted an umbrella Data Protection Impact Assessment (DPIA) on self-hosted Nextcloud Enterprise, open-source collaboration software.
Nextcloud
AFAS and SURF are taking the next step together following the DPIA
SURF has carried out a Data Protection Impact Assessment (DPIA)...
AFAS
Memo published on Pure (Elsevier): four recommendations for institutions
SURF Vendor Compliance has published a memo on Pure, Elsevier’s Research Information System.
Pure
SURF provides (in collaboration with partners):
- The conducting risk analyses (including DPIAs and DTIAs);
- performing security and compliance checks, including data transfers outside the EEA, with legal and technical investigations;
- establishing, delivering and applying review frameworks against which suppliers are reviewed;
- making agreements with suppliers, such as processor agreements, that mitigate privacy risks and agree on security measures;
- providing information and support on how institutions can use the assessed applications/(cloud) software as securely as possible;
- monitoring suppliers' compliance with agreements made.
What are the benefits of Vendor Compliance?
By taking up assessments together, we have a strong negotiating position towards suppliers; we speak on behalf of the entire research and education sector.
By pooling expertise, institutions individually save costs and time.
Institutions get the building blocks they need to make their own trade-offs for the secure use of assessed applications/(cloud) software.
Do you have a question or want to communicate your desire about a compliance assessment
By talking to suppliers and staying in dialogue, we agree on the best privacy and security conditions for research and education.
If you have a question about a compliance program, please contact us or send us your requirements via the button below.