Tagged
Procurement
NIS2 supplier contracts need eight security clauses. A DPA covers five at best.
NIS2's implementing regulation names eight things your supplier contracts have to specify. By my count a GDPR data proc…
20 Sep 2026
Swapping a vendor that touches customer data? Notify your customers before it goes live.
GDPR Article 28(2) requires your customer's written authorisation before a new or replacement vendor processes their da…
7 Sep 2026
Do you need a DPA with every vendor? Sort your list into three groups first.
No. GDPR Article 28(3) requires a written contract only where a vendor is your processor, meaning it handles the data o…
26 Aug 2026
An auditor keeps your security honest. Nothing keeps your privacy policy honest.
A SOC 2 audit examines the security controls you scoped into it, and platforms like Vanta collect the evidence for that…
24 Aug 2026
Enterprise buyers read your privacy policy before they read your pricing
Enterprise buyers are legally required to vet you: GDPR Article 28 lets a controller use only processors providing suff…
18 Aug 2026
Charging a customer to take their data out stops being legal on 12 January 2027
The EU Data Act's switching rules cover Software as a Service, not just connected machinery, and have applied since 12…
6 Aug 2026
NIS2 is nearly two years late in four countries. It reached your sales cycle on time.
NIS2 had to be in national law by 17 October 2024, and in July 2026 four member states were referred to the EU Court fo…
3 Aug 2026