Next steps: Contracts, governance and advice

Start with the obligation's legal job

Do not negotiate a generic promise that the supplier will maintain "industry-standard security." First identify what the clause must enable the customer to prove, monitor, and correct.

For GDPR processing, Article 32 requires risk-appropriate technical and organisational measures, including regular testing and evaluation where appropriate. A processor must also notify the controller of a personal data breach without undue delay after becoming aware of it. The contract should therefore turn supplier security activity into evidence the controller can use.