{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Home","Read this first","Assessment","Create Vendor","Vendor Records"],"not_rendered":{"charts":2,"images":4,"macros":1,"external_links":0,"defined_names":1,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Home","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Read this first","index":1,"n_rows":13,"n_cols":3,"rows_kept":13,"cut":false,"hidden":false,"merged":[[1,1,1,2]]}
[]
[null,"PLEASE READ THE BELOW BEFORE PROCEEDING WITH THE TOOL"]
[null,"What is this tool?","This Excel -based assessment and management  tool has been developed by National Data Privacy Office (NDPO) to assist the organizations (Data Controllers) with the following: \n- To evaluate the Privacy posture of existing vendors as part of periodic audits\n- To evaluate the Privacy posture of prospective vendors as part of Vendor due diligence\n- To maintain a record of all vendors that process personal data and have visibility on the nature of processing activities carried out by them. \n\nThis tool utilizes excel macros to automate certain tasks such as creating a vendor, adding the vendor entry to the vendor records, creating a dedicated assessment sheet for a particular vendor, producing the assessment results in the form of dashboards, etc. "]
[null,"Scope  ","The scope of this tool applies to evaluating and managing the privacy and information security posture of existing and prospective data processing vendors. This includes ensuring compliance with data protection regulations, assessing operational and security controls, maintaining a record of all vendors, and having visibility on the nature of processing activities carried out by them.\n\nThis tool is designed for use by the relevant team within the Data controller's organization that is tasked with managing Privacy Compliance with adequate support from the Legal Team, Procurement Team, and Business Functions. "]
[null,"Why is it required to evaluate Vendors from a Privacy and security standpoint?","Vendor Privacy Management Tool plays a significant role in safeguarding the organization's data privacy and security throughout the vendor lifecycle. The importance of this tool stems from several pivotal factors, all focused on the below core objectives:\n- Ensuring Regulatory Compliance\n- Evaluating the Privacy Posture of Existing and Prospective Vendors\n- Managing and Reducing Privacy Risks Associated with Vendors\n- Maintaining Comprehensive Records of Vendor Activities\n- Improving Trust and Transparency in Vendor Relationships\n- Facilitating Informed Decision-Making Regarding Vendor Engagements. "]
[null,"What areas/domains are covered in the tool","The control library used to evaluate the vendors can be categorized into the following six domains:\n- Privacy Governance: Ensuring vendors have a robust governance structure, clear policies, procedures, and accountability mechanisms.\n- Data Lifecycle Management: Managing personal data appropriately at each stage, adhering to data minimization and retention principles.\n- Individual Rights Management: Providing mechanisms for individuals to exercise their rights in compliance with data protection laws.\n- Audits and Assessments: Conducting regular audits and evaluations to ensure ongoing compliance and risk mitigation.\n- Security Measures: Implementing appropriate security controls to protect data from unauthorized access, disclosure, alteration, and destruction.\n- Data Breach Management: Establishing clear protocols for managing, reporting, and mitigating data breaches."]
[null,"What are the various sheets within the workbook?","Read this first: This sheet provides an overview of what the tool is all about and how it is meant to be used.\nCreate Vendor: This sheet is used for creating a vendor and adding the same to Vendor Records. \nVendor Records: This sheet is used for maintaining the records of all Vendors who process personal data. \nAssessment Sheets for each of the vendors : When the details of the vendor are entered in the 'Create Vendor' sheet and when followed up by clicking on 'Perform Assessment' button,  an assessment sheet named after the vendor will be created."]
[null,"What are the various effectiveness levels?","There are four compliance levels for every control that are determined after evaluating the controls. They are:\nCompliant: The vendor fully meets all the specified requirements as stated in the control.\nPartially Compliant: The vendor meets some, but not all, of the specified requirements as stated in the control.\nNon-Compliant: The vendor fails to meet the specified requirements as stated in the control.\nNot Applicable: The specified control requirement does not apply to the vendor's operations or services."]
[null,"How to perform the assessment?","Step 1: Create Vendor\nNavigate to the 'Create Vendor' sheet and enter the necessary details about the vendor. After filling in all required fields, click on the 'Add Vendor to Records' button to add the vendor's information to the 'Vendor Records' sheet. Further, if you want to clear the contents in the 'Create Vendor' sheet, click on the 'Clear Contents' button to clear the contents of the response fields in the sheet. \n\nStep 2: Initiate Assessment\nDepending on the inputs provided in the 'Create Vendor' sheet, the sheet automatically calculates whether an assessment is required or not. If an assessment is recommended, then the team/individual handling vendor compliance should proceed to perform an assessment. There is a button 'Perform Assessment' available on the the 'Create Vendor' sheet that will automatically generate a new Assessment sheet named after the vendor. \n\nStep 3: Perform Assessment\nThe assessment is recommended to be initiated by the Team handling PDPPL compliance in assistance with other teams such as Procurement, Legal and Business Teams. To begin the assessment, go to the vendor-specific sheet created after clicking 'Perform Assessment.' Evaluate the compliance status of each control in the assessment sheet. After completing the assessment, click on the 'Update Score' and 'Click to View Results' buttons (located near the bottom of the control listing) to update the vendor's privacy score in the 'Vendor Records' sheet and view the assessment results dashboard, respectively. Further, there is a button 'Click to view non compliant and partially compliant controls', which will tabulate all the Non Compliant and Partially Compliant controls. \n\nStep 4: Maintain Vendor Records\nRegularly review the 'Vendor Records' sheet and update the vendor information as necessary to ensure accuracy and completeness."]
[null,"Scoring Criteria and Calculation","In terms of scoring, controls categorized as 'Not Applicable' are excluded from the scoring calculation. Controls assessed as 'Partially Compliant' receive a score of 1, while those rated as 'Compliant' receive a score of 2. Controls assessed as 'Ineffective' receive a score of 0.\n\nTo calculate the overall Vendor Privacy Score, we use the following formula:\n(((Number of Effective Controls * 2) + (Number of Partially Effective Controls * 1)) / (2*Total Number of Applicable Controls))*100\n\nThis formula provides a score on a scale of 0 to 100, reflecting the compliance levels of privacy requirements applicable to the vendor. "]
[null," Macros","The tool has been developed using Macros, and it is essential to exercise prudence by adhering to your organization's policy on macros usage. \n\nEnabling macros can enhance functionality but also presents potential security risks. Be vigilant about the source of the file and ensure it comes from a trusted and reputable source.\n\nIf you have any concerns or questions about enabling macros or if your organization restricts macro usage, we strongly recommend contacting your IT administrator or IT security team for guidance. Your cybersecurity and data security are paramount, and following these steps responsibly is essential to protect your systems and data."]
[null,"Disclaimer","\nThe creators and providers of this tool, Qatar National Data Privacy Office (NDPO), disclaim any liability for the use or interpretation of this report and do not assume any responsibility for the consequences of decisions or actions taken based on the information contained herein. Organizations are ultimately responsible for their privacy practices and compliance efforts by regularly reviewing and updating relevant privacy policies and practices to maintain ongoing compliance.\n"]
[null,"Copyright and Licensing Information","Vendor Privacy Management Tool © 2024 by National Data Privacy Office (NDPO) is licensed under Attribution-NonCommerical-NoDerivatives 4.0 International"]

{"sheet":"Assessment","index":2,"n_rows":42,"n_cols":25,"rows_kept":42,"cut":false,"hidden":true,"merged":[[2,1,3,7],[4,1,5,7],[3,10,4,17],[13,10,13,12]]}
[]
[]
[null,"Vendor Privacy Assessment"]
[null,null,null,null,null,null,null,null,null,null,{"$f":"_xlfn.CONCAT(\"Assessment Results - Score Card and Dashboard for \", B5)","v":"Assessment Results - Score Card and Dashboard for "}]
[]
[]
[null,"Area","Control Ref","Control Title","Control Description","Compliance Status","Observation","Recommended Action Plan"]
[null,"Privacy Governance","PG_1","Privacy Office or Privacy Officer","The Data Processor (Vendor) should appoint a Data Privacy Officer or establish a Privacy Office or have a dedicated team to manage all matters related to Privacy Compliance. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Area","Compliant","Non Compliant","Partially Compliant","Not Applicable","Total"]
[null,"Privacy Governance","PG_2","PDMS","The Data Processor (Vendor) should implement a Personal Data Management System (PDMS) to systematically manage all privacy-related activities and ensure compliance with PDPPL requirements as a Data Processor. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Privacy Governance",{"$f":"COUNTIFS($B$8:$B$42, T9,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T9,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T9,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T9,$F$8:$F$42, Assessment!$X$8)","v":0},{"$f":"SUM(U9:X9)","v":0}]
[null,"Privacy Governance","PG_3","Privacy awareness ","The Data Processor (Vendor) should provide regular privacy awareness training to all employees, ensuring they understand their responsibilities regarding data protection and privacy.",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Data Lifecycle Management",{"$f":"COUNTIFS($B$8:$B$42, T10,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T10,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T10,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T10,$F$8:$F$42, Assessment!$X$8)","v":0},{"$f":"SUM(U10:X10)","v":0}]
[null,"Privacy Governance","PG_4","Data Processing Agreement","The Data Processor (Vendor) should execute a Data Processing Agreement (DPA) with the Data Controller outlining their obligations under PDPPL and responsibilities as a Processor. \nThe executed Data Processing Agreement should, at a minimum, include the following: \n- the subject matter and duration of the processing\n- the nature and purpose of the processing\n- the types of personal data being processed, and the categories of individuals\n-  the controller’s duties and rights inlcuding right to audit\n- the requirement that the processor must only process the personal data based on the controller’s documented instructions\n- terms of data retention\n- obligations to notify breaches in a timely manner\n- appropriate security measures\n- the use of sub-processors\n- the duty of confidentiality.",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Individual Rights Management",{"$f":"COUNTIFS($B$8:$B$42, T11,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T11,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T11,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T11,$F$8:$F$42, Assessment!$X$8)","v":0},0]
[null,"Privacy Governance","PG_5","Confidentiality clauses","The Data Processor (Vendor) should include confidentiality clauses in contracts with all employees and contract staff who have access to the personal data shared by the controller. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Audits and Assessments",{"$f":"COUNTIFS($B$8:$B$42, T12,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T12,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T12,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T12,$F$8:$F$42, Assessment!$X$8)","v":0},0]
[null,"Privacy Governance","PG_6","Documented Instructions","The Data Processor (Vendor) should have documented procedures on how they will process personal data received from the Data Controller. Further, these documented procedures should be socialized with all the relevant personnel who are directly involved in such processing. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Security Measures",{"$f":"COUNTIFS($B$8:$B$42, T13,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T13,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T13,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T13,$F$8:$F$42, Assessment!$X$8)","v":0},0]
[null,"Privacy Governance","PG_7","Usage of Sub Processors","The Data Processor (Vendor) should not use any Sub Processor for the processing of Data Controllers data without the prior written authorization from the controller. Further, the Data Processor (Vendor) should ensure that such sub processors are bound by the same level of privacy and data protection obligations as stipulated in the Data Processing Agreement executed between the Data Processor and the controller. ",null,null,null,null,null,"LIST OF NON COMPLIANT AND PARTIALLY COMPLIANT CONTROLS",null,null,null,null,null,null,null,null,"Data Breach Management",{"$f":"COUNTIFS($B$8:$B$42, T14,$F$8:$F$42, Assessment!$U$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T14,$F$8:$F$42, Assessment!$V$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T14,$F$8:$F$42, Assessment!$W$8)","v":0},{"$f":"COUNTIFS($B$8:$B$42, T14,$F$8:$F$42, Assessment!$X$8)","v":0},{"$f":"SUM(U14:X14)","v":0}]
[null,"Data Lifecycle Management","DLM_1","Data Collection","The Data Processor (Vendor) should only receive requisite personal data attributes from the Data Controller in alignment with the purpose of processing. ",null,null,null,null,null,"Control Ref","Control Title","Compliance Status"]
[null,"Data Lifecycle Management","DLM_2","Data Usage ","The Data Processor (Vendor) should use and process personal data only as per the documented instructions of the Data Controller. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"SUM(U9:U15)","v":0},{"$f":"SUM(V9:V15)","v":0},0,0,{"$f":"(U16*2+W16*1)/(2*(SUM(U16:X16)-X16))","v":{"$error":"#DIV/0!"}}]
[null,"Data Lifecycle Management","DLM_3","Data Storage","The Data Processor (Vendor) should limit the storage of personal data within their environment in accordance with the purpose of processing as stated in the contractual agreement executed with the Data Controller. "]
[null,"Data Lifecycle Management","DLM_4","Data Disclosures","The Data Processor (Vendor) should not disclose personal data to another party (such as a sub processor) without the prior written authorization from the Data Controller. "]
[null,"Data Lifecycle Management","DLM_5","Data Disposal ","The Data Processor (Vendor) should ensure personal data is returned or deleted post expiry of the contract with the Data Controller. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Overall Privacy Score of "]
[null,"Data Lifecycle Management","DLM_6","Maintain Records of Processing Activities","The Data Processor (Vendor) should maintain a Record of all the Data Processing Activities that it carries out on behalf of the Controller. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"B5","v":0}]
[null,"Individual Rights Management","IRM_1","Notify controllers on receiving Individual Rights Requests","The Data Processor (Vendor) should implement adequate processes in place to notify the Data Controller on any individual rights requests that they may receive directly from the individuals. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," is "]
[null,"Individual Rights Management","IRM_2","Facilitate controllers - Documented Process","The Data Processor (Vendor) should have a defined and documented process in place to facilitate Data Controllers in responding to Individual requests in a timely manner. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"ROUNDUP(Y16*100,0)","v":{"$error":"#DIV/0!"}}]
[null,"Individual Rights Management","IRM_3","Implement system level controls ","The Data Processor (Vendor) should ensure that the systems used for processing should allow them to search, extract, modify and delete all instances of an individual's personal data. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null," out of 100"]
[null,"Individual Rights Management","IRM_4","Maintain records of all requests received","The Data Processor (Vendor) should record all the Individual Rights Requests that they received in a separate register. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IFERROR(_xlfn.CONCAT(Y19:Y23), \"Assessment is yet to be performed\")","v":"Assessment is yet to be performed"}]
[null,"Audits and Assessments","AA_1","Assist in Audits","The Data Processor (Vendor) should assist the Data Controller in providing all relevant information for the purpose of Data Privacy Audits. ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IFERROR(_xlfn.CONCAT(Y22:Y23), \"Assessment is yet to be performed\")","v":"Assessment is yet to be performed"}]
[null,"Audits and Assessments","AA_2","Assist in performing DPIAs","The Data Processor (Vendor) upon the Data Controller's request, provide necessary assistance in conducting Data Protection Impact Assessments (DPIAs) for the relevant processing activities. "]
[null,"Audits and Assessments","AA_3","Assist in carrying out Privacy by Design Assessments","The Data Processor (Vendor) should assist the Data Controller in performing Privacy by Design Assessments on any underlying system that is used by the processor for processing personal data on behalf of the controller. "]
[null,"Security Measures","SEC_1","ISMS","The Data Processor (Vendor) should have a well-established Information Security Management System to protect the confidentiality, integrity and availability of all personal data processed by them. "]
[null,"Security Measures","SEC_2","Access Controls","The Data Processor (Vendor) should implement appropriate access controls to ensure access to personal data is restricted to authorized personnel. "]
[null,"Security Measures","SEC_3","Audit Logging and Monitoring","The Data Processor (Vendor) should implement appropriate measures to log all the activities of systems involving personal data processing and monitor the same to detect any anomalies. "]
[null,"Security Measures","SEC_4","Encryption - at rest","The Data Processor (Vendor) should ensure appropriate levels of data encryption are applied on systems and data stores that retain personal data that are used for storing personal data associated with the processing activities that are carried out on behalf of the controller. "]
[null,"Security Measures","SEC_5","Encryption - in transit","The Data Processor (Vendor) should ensure all personal data transmission channels are encrypted with an appropriate level of encryption. "]
[null,"Security Measures","SEC_6","Network Security","The Data Processor (Vendor) should implement appropriate safeguards (such as a Firewall, IDS/IPS, etc.) to secure the network used for processing personal data on behalf of the Controller. "]
[null,"Security Measures","SEC_7","Data Integrity","The Data Processor (Vendor) should implement appropriate measures to ensure the accuracy and completeness of personal data throughout its lifecycle. This includes using checksums, hashes, and other integrity verification mechanisms to detect and prevent data corruption, unauthorized modification, or tampering."]
[null,"Security Measures","SEC_8","Data Availability","The Data Processor (Vendor) should implement appropriate measures to ensure the availability of personal data to authorized users when needed. This includes maintaining adequate backups, disaster recovery plans, and redundancy mechanisms to protect against data loss and ensure business continuity."]
[null,"Security Measures","SEC_9","Vulnerability  Management","The Data Processor (vendor) should implement a robust vulnerability management program, specifically for all systems and applications used in processing the controller's data. This includes regular identification, assessment and timely remediation of vulnerabilities, with prompt application of security patches to safeguard against potential exploits. "]
[null,"Data Breach Management","DBM_1","Incident Response Plan","The Data Processor (Vendor) should develop and maintain an Incident Response Plan that outlines the procedures for detecting, reporting, and responding to data breaches. This plan should include:\n- Defined roles and responsibilities for the incident response team\n- Steps for immediate containment and mitigation of the breach\n- Communication protocols to notify relevant stakeholders\n- Procedures for post-incident analysis and improvement."]
[null,"Data Breach Management","DBM_2","SLAs defined","The Data Processor (Vendor) should establish and enforce Service Level Agreements (SLAs) with the Data Controller to ensure timely response and resolution of data breaches."]
[null,"Data Breach Management","DBM_3","Breach detection capabilities","The Data Processor (Vendor) should implement robust breach detection capabilities to identify potential data breaches in real-time. "]
[null,"Data Breach Management","DBM_4","Notify breaches","The Data Processor (Vendor) should establish a clear protocol for notifying Data Controller of a data breach without undue delay. "]
[null,"Data Breach Management","DBM_5","Facilitate in investigations","The Data Processor (Vendor) should assist the Data Controller in investigations pertaining to data breaches. This should include: \n- Preserving evidence related to the breach.\n- Providing access to logs, records, and other relevant data to the Data Controller.\n- Assisting in identifying the root cause of the breach and implementing corrective actions"]
[null,"Data Breach Management","DBM_6","Indemnity clause for Data breach protection","The contractual agreement executed with the Data Processor (Vendor) should include indemnity clauses for personal data breach protection, ensuring coverage for any liabilities, losses or damages arising from data breaches. "]

{"sheet":"Create Vendor","index":3,"n_rows":28,"n_cols":3,"rows_kept":28,"cut":false,"hidden":false,"merged":[[2,1,2,2]]}
[]
[]
[]
["S.No","Initital Information","Response"]
[]
[1,"Name of the Vendor"]
[]
[2,"Contact details of the Vendor"]
[]
[3,"Does the vendor process personal data? "]
[]
[4,"What services are being offered by the vendor?","Eg. The vendor provides payroll processing service. "]
[]
[5,"Please provide a description of the personal data processing activities carried out by the Vendor","Eg. \nActivity 1: Collection and maintaining records of employees\nActivity 2: Payroll calculation\nActivity 3: Data storage and management"]
[]
[6,"Please provide a list of personal data attributes processed by the Vendor","Eg. Name, QID, Email Address, Phone no., Salary details, etc. "]
[]
[7,"No. of individual records processed by the Vendor"]
[]
[8,"Does the vendor store personal data in their data environment?  "]
[]
[9,"When does the contract with vendor expire? ","<Enter the month and year of contract expirt>"]
[]
[10,"Is the Vendor based out of Qatar? "]
[]
[11,"Does the data processing (by the Vendor) take place within Qatar? "]
[]
[12,"Is it recommended to perform a comprehensive Assessment",{"$f":"IF(C10=\"\",\"\",IF(C10=\"No\",\"No Assessment is required\",IF(AND(C18=\"Less than 100\",C20=\"No\",C26=\"Yes\"),\"Assessment is not recommended\",\"Assessment is recommended\")))","v":""}]

{"sheet":"Vendor Records","index":4,"n_rows":2,"n_cols":9,"rows_kept":2,"cut":false,"hidden":false,"merged":[[0,0,0,8]]}
["Records of Vendors"]
["S.No","Vendor Name","Contact details","List of personal data processed","Processing activity details as per Contractual agreement","Volume of personal data processed","Duration of contract with the Vendor","Updates to the Processing activites, if any","Assessment Results"]