- We should have a non-disclosure and confidentiality agreements with all personnel even ours , subcontractor, staff even part time staff in paper (or electronic format) written on it “under the GDPR rules”
- The supplier should report any data breech
- We should have a copy of this saved