Lesson 14 of 26

Samira assesses a processor abroad

For: Data Protection OfficerAbout 8 min

What you will be able to do

This lesson is for the Data Protection Officer. When customer data goes to a company outside the UAE, you need to know the processor's risks and whether the transfer is safe: a vendor risk review and a transfer impact assessment, a TIA. You will ask Samira, the AI agent for data protection, to do both for the web shop's hosting provider in the US, answer her questions, and find the assessment waiting for your approval.

Before you start

  • You are signed in as the Data Protection Officer, with access to Meridian Souq E-Commerce FZ-LLC.
  • Nimbus Cloud Services Inc, in the US, hosts the web shop's order database and is listed as a processor.

Steps

  1. 1

    Ask Samira for the review and the TIA

    On Meridian Souq E-Commerce FZ-LLC, open the AI team's Chat, type @ and pick Samira, and type: our web shop's order database is hosted by Nimbus Cloud Services Inc in the US. Please run the vendor risk review for Nimbus and the transfer impact assessment for sending our customers' data to them, and send them to me for approval.

    • Type Message to the AI team: @Sam
    • Choose SSamiraAIData protection officer
    • Type Message to the AI team: @Samira our web shop's order database is hosted by Nimbus Cloud Servic…
  2. 2

    Select Send

    Select Send. Samira's card under your message is marked Working.

    • Select Send
  3. 3

    Read Samira's to-do list

    Samira writes a to-do list for both pieces of work: the vendor's risk profile and questionnaire, the transfer record, the transfer impact assessment, and submitting it for your approval. The ticks fill in as she works.

    The screen at step 3: Read Samira's to-do list
  4. 4

    Answer Samira's questions and go-aheads

    Samira asks, in one message, what the records don't hold: who at Nimbus should receive the privacy questionnaire, what legal safeguard covers the transfer, with answer choices, how many customers are affected, who holds the encryption keys, who at Nimbus can see the data, and what the privacy notice says. Type your answers together and select Send. Three go-aheads follow: record the transfer's safeguard as not yet signed, send the questionnaire to the vendor's contact by secure link, and submit the TIA. Read each and select Approve.

    • Type Your answer: 1. Nimbus contact: Dana Whitfield, privacy@nimbuscloud.example.com; du…
    • Select Send
    • Select Approve
    • Select Approve
    • Select Approve
  5. 5

    Read Samira's answer

    Samira's green Answer says the TIA is waiting for your approval in the Approvals inbox, with every required question answered. Its outcome is that the transfer is not permitted yet: nothing signed binds Nimbus to the UAE rules, nothing controls its sub-processors, and Nimbus holds the encryption keys. Approving the TIA approves that finding; it doesn't clear the transfer. The vendor review waits for Nimbus's answers to the questionnaire, due 20 November. Samira ends with your next steps, such as getting a data processing agreement signed and updating the privacy notice.

  6. 6

    Find the assessment in Data Protection

    In the left menu, open Data Protection; Cross-Border shows one transfer, marked high risk, and the metrics count one transfer without an approved TIA. The TIA itself waits in Approvals, with a 1 beside it in the left menu. The decision is yours.

How to check it worked

Samira's green Answer gives the TIA's finding and says it waits in your Approvals inbox, and that the vendor review waits for the vendor's questionnaire. Data Protection, Cross-Border lists the transfer to Nimbus as high risk.

Common mistakes

  • Treating the agent's assessment as the decision. You approve or reject the transfer.
  • Answering questions you don't know. Say what you don't know; Samira can put it in the questionnaire to the vendor.

Check your understanding

  1. 1. Why is a TIA needed for the US hosting provider?

    1. A.Every supplier needs one
    2. B.Customer data leaves the UAE, so the transfer's safeguards must be assessed
    3. C.To compute VAT
    4. D.It is optional
    Show answer

    Answer: B. Customer data leaves the UAE, so the transfer's safeguards must be assessed

    Transfers abroad need safeguards; the TIA records whether they are adequate.

  2. 2. Who approves the vendor review and the TIA?

    1. A.Samira
    2. B.The DPO
    3. C.The vendor
    4. D.The tax manager
    Show answer

    Answer: B. The DPO

    Agents prepare and submit; the DPO decides.