Skip to content
PrivacyBuilt

Advanced

Vendor Risk, Data Processing Agreements and International Transfers

Build a risk-based vendor and transfer lifecycle covering due diligence, contracts, subprocessors, security evidence, transfer mechanisms, monitoring and exit.

4 hours9 modules8 lessonsFree certificate

About this course

An advanced course for privacy, procurement, security and legal operations teams that must govern third parties end to end. Each module produces part of a working lifecycle: a data-flow and role map, a risk-tiering method, a data-processing agreement standard, an assurance evidence set, a subprocessor and AI supply-chain control, a transfer mechanism selection matrix, a transfer risk assessment method and a monitoring and exit routine. Contracts, certifications and questionnaires are treated as inputs to a risk decision, never as proof of compliance on their own.

What you will be able to do

  • Map vendor data flows and distinguish controller, processor, service-provider and independent-recipient roles
  • Apply proportionate due diligence and document risk decisions
  • Negotiate and operate practical data-processing terms
  • Select and assess lawful international-transfer mechanisms without treating contracts as a complete risk solution
  • Monitor vendors, subprocessors and offboarding evidence throughout the relationship

Course content

  1. 1

    Data-flow and role mapping

    Start from the activity and purpose, then establish each party's role before writing any contract terms.

    • Data-Flow and Role Mapping35 min

    4-question quiz

  2. 2

    Risk tiering and due diligence

    Apply proportionate diligence based on data, access, criticality and resilience, and record the acceptance decision.

    • Risk Tiering and Due Diligence32 min

    4-question quiz

  3. 3

    Data Processing Agreements

    Turn contract clauses into operable duties for instructions, subprocessors, assistance, audits and deletion.

    • Data Processing Agreements32 min

    4-question quiz

  4. 4

    Security, assurance and incident evidence

    Read certifications and audit reports critically, and set notification routes and evidence freshness rules.

    • Security, Assurance and Incident Evidence32 min

    4-question quiz

  5. 5

    Cloud, subprocessors and AI supply chains

    Keep visibility of the chain, control change notices, training-use terms and fourth-party concentration.

    • Cloud, Subprocessors and AI Supply Chains32 min

    4-question quiz

  6. 6

    International transfer mechanisms

    Select adequacy, standard clauses, binding corporate rules or a narrow derogation on a documented basis.

    • International Transfer Mechanisms32 min

    4-question quiz

  7. 7

    Transfer risk assessments and supplementary measures

    Assess destination law and practice, apply measures that work and document residual risk.

    • Transfer Risk Assessments and Supplementary Measures30 min

    4-question quiz

  8. 8

    Monitoring, renewal and exit

    Reassess on triggers, track metrics and incidents, and close relationships with verified deletion evidence.

    • Monitoring, Renewal and Exit30 min

    4-question quiz

  9. 9

    Final AssessmentFinal assessment

    Confirm your understanding across the full course.

    10-question final assessment