Data
Before a supplier receives customer data
Starting point
Start with a flow map. Record what data goes to the supplier, for what purpose, who can access it and where it is processed. Then compare that picture with the roles and obligations stated in the documents.
What to agree in practice
Test a change of subcontractor, an incident and termination. Agree who receives notices, what they should contain and how you confirm return or deletion of data. Make sure the operational team can run the process.