Exam CIPP-US topic 1 question 29 discussion

To transfer personal data to a third party acting as an agent, organizations must: Accountability for Onward Transfer... (i) Transfer such data only for limited and specified purposes; (ii) Ascertain that the agent is obligated to provide at least the same level of privacy protection as is required by the Principles; (iii) Take reasonable and appropriate steps to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organization’s obligations under the Principles; (iv) Require the agent to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles; (v) Upon notice, including under (vi) Take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vii) Provide a summary or a representative copy of the relevant privacy provisions of its contract with that agent to the Department upon request.