Supplier Due Diligence Survey

This questionnaire is designed to be completed by third parties who process personal data on a small scale and potentially one-off basis for the Labour Party. This could include third parties that process personal data to provide printing services, telephone systems, back-up servers and print systems.

Once you complete the questionnaire it will be reviewed by the Labour Party’s Data Protection Officer in order to provide any further technical advice and feedback. The responses will be retained on Labour Party servers for 20 years after the lifetime of any contract with a third party – this is documented in the Party’s internal retention policy. Any questions should be directed to the contract owner within the Labour Party who will liaise with the Data Protection Officer as appropriate.

The Labour Party: due diligence questionnaire for third party data controllers / processors

Please complete all questions below;
1. Your name:*
2. Your organisation:*
3. Who has overall responsibility for data protection compliance in your organisation? Please include contact details and job title:*
4. Who is your data protection supervisory authority?*
5. Do you hold any data protection or information security certifications? (eg ISO 27001)
Drop files here or

Max. file size: 50 MB.
6. Please provide copies of your privacy notice(s) and data protection policy.*
Drop files here or

Max. file size: 50 MB.
7. Please provide any further comments around your privacy notice and data protection policy here as you see fit:*
8. Does your organisation transfer personal data outside the European Economic Area? If yes, what is the legal basis and what are the safeguards you have in place? For any US data transfers, information is required in this section around how the recent court ruling on Privacy Shield may have impacted your organisation?*
9. Has your organisation provided training to employees on data protection compliance?*
10. Is data protection compliance referred to in employee / other worker contracts?*
11. Please describe your data protection compliance policy review and approval process?*
12. Does your organisation collect personal data from individuals under 16 years of age? If so, do you actively seek parental consent?*
13. Have you carried out any risk or impact assessments in relation to the collection and management of personal data?*
14. Do you have a process for dealing with individuals making requests under Articles 15-22 GDPR? If so, please provide details about your process for dealing with subject access requests within an appropriate timescale:*
15. Please describe your process for correcting inaccurate records, deleting records or suspending the processing of personal data:*
16. Does your organisation have documented data retention periods? If so, do these cover contractual and legal requirements to retain personal data?*
17. Do you have any third party statements of compliance with the requirements of the GDPR? If so, who assessed your organisation’s compliance?*
18. Do you have mechanisms in place which allow individuals to remove consent for processing their personal data?*
19. For each piece of personal data held, how do you record the purpose for which it was obtained?*
20. For each piece of personal data held, how do you record the applicable lawful basis for obtaining it?*
21.What safeguards do you have in place when you process special category data? Please type N/A if you do not process this type of personal data.*
22. How do you distinguish between when your organisation and other organisations are acting as independent controllers, joint controllers or processors?*
23. Where you disclose personal data to a supplier or service provider, do you enter into terms which satisfy the requirements of Article 28 GDPR?*
24. Please set out, in brief, details about your organisational and technical data security measures:*
25. What is your process for notifying personal data breaches to your supervisory authority and, where relevant, affected data subjects?*
Untitled

Supplier Due Diligence Survey

The Labour Party: due diligence questionnaire for third party data controllers / processors

Please complete all questions below;