MULTI-SELECT (Select 3 of 5)(A multinational manufacturing company is considering outsourcing its HR data processing...

For a processor handling sensitive HR data—especially with cross-border considerations—the contract/DPA should cover:

Security obligations (D):required technical/organizational measures, access control, encryption, segregation, audit rights, subcontractor controls.

Breach/incident handling (A):notification timelines, cooperation duties, investigation, remediation, evidence, and communications alignment.

Transfer terms (C):how international transfers occur and what safeguards apply (e.g., SCCs/BCRs/other permitted safeguards), plus onward transfer restrictions.Insurance (B) may be useful commercially, and cost reduction (E) is not a privacy protection requirement.

=============