What would you check before allowing a vendor to process sensitive client data?

Instruction: Prioritize the due-diligence questions, name the decision owners, and propose a useful pilot while key answers are missing.

Context:

A fictional consultancy is evaluating an AI service for summarizing customer support cases that contain names, contact details, and confidential account notes. The vendor advertises encryption and says it does not train on business data, but the team has not checked retention, subprocessors, support access, deletion, or incident terms. No customer records have been uploaded.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

I would start by mapping the minimum data the task needs and whether we are permitted to use it this way. Names and contact details may be unnecessary for a useful summary, so I would test redaction or field removal before transferring anything...

Upgrade to view official answer

Related Questions