GDPR and security questionnaires for vendor assessment

The document may be attached to the agreement, incorporated by reference or used to negotiate warranties. Terms such as encrypted, EU hosted, GDPR compliant or 24/7 monitoring must be defined and checked before ticking a box.

Answers may involve several teams: legal for roles and transfers, security for controls, product for functionality and HR for staff access. One process owner must coordinate the final version.

Questionnaires differ but repeatedly assess data governance, service security and the provider’s ability to respond to incidents and requests.

• Roles and purposes: controller, processor, instructions and own uses.
• Data and location: categories, regions, data centres and remote access.
• Subprocessors: list, services, countries and change mechanism.
• Transfers: adequacy, SCCs, assessments and supplementary measures.
• Security: access, encryption, logs, development, vulnerabilities and backups.
• Incidents: detection, notification times and cooperation.
• Rights and deletion: functionality, deadlines and final confirmation.

Every important answer should link to evidence: an approved policy, diagram, audit report, certificate, restoration test or contractual clause. Certification may support a statement but does not automatically prove every requested control or feature.

Where a question assumes an inaccurate situation, the answer should be qualified rather than forced into yes. An explanatory schedule can define the service, remediation plan or option available only in a particular package.

An internal library of approved responses saves time, but every version must be dated and linked to evidence. Cloud migration, a new subprocessor or an incident may make an old answer inaccurate.

Negotiated commitments must reach the service delivery team. Special notification, location or audit obligations belong in the contract register, not merely the sales team’s email.