TikTok Data Security and Privacy Questionnaire Companion

Does your organization have a published information security policy or program?

Does your organization enforce network segregation and implement protection measures to monitor and prevent network threats?

Does your organization install anti-virus software on company endpoints?

Does your organization implement a security baseline for daily operations? Such as screen locking, password complexity, a clear-desk policy, multi-factor authentication, etc.

Does your organization have a published access control policy and restrict personal data access to systems based on the principle of least privilege?

Does your organization have a published data classification policy and encrypt sensitive data both in-transit and at-rest?

Does your organization have a published incident response policy with clarified roles and responsibilities, as well as incident reporting/communication channels?

Does your organization have a vulnerability or threat management procedure in place?

In the past 3 years, have you experienced any breach of security leading to the accidental or unlawful exposure of personal data which you notified (or were legally required to notify) to: (i) a governmental or regulatory authority; or (ii) a former or existing customer. If yes, please provide details.

In the past 3 years, have you received a complaint, objection, or similar notice or correspondence from any data protection or other regulatory authority, or any former or existing customer or individual, relating to your processing of personal data? If yes, please provide details.

In which country(ies) will the data be physically stored or processed?

Does your organization have an internal personal data protection policy and is it regularly updated?

Will you assist sellers or TikTok Shop to delete/update/provide data upon users' requests?

Does your organization maintain a regularly updated privacy policy?

Does your organization have an appointed Data Protection Officer (DPO)? If yes, please provide the DPO's contact email.

Does your organization have a notification process to alert us or sellers of suspected/identified data breaches?

At the end of the contractual relationship, will you delete all collected customer data in your possession?

Have you obtained any ISO27001/ISO27701/SOC2 Type2/ePrivacy or other industry-acknowledged information security or privacy-related certifications? (Optional)