Template
Data Privacy and GDPR Vendor Questionnaire
A short, twelve-question form for deciding whether a vendor can handle personal data — answers, evidence, red flags and a recorded decision, in six pages.
An editable 6-page form for a privacy review that has to be done properly but does not warrant a full assessment. Answer each question Yes, Some, No or N/A, keep one piece of evidence against each, and finish with a decision you can show someone.
What’s inside
- A front sheet for vendor, service, business owner, data used, reviewer, review date, risk level and status
- Twelve questions covering what personal data is used and why, where it is stored and accessed, sub-processors, the data processing agreement, access control, encryption in transit and at rest, incident notification, data subject requests, return or deletion at exit, transfers outside the EEA, staff training, and notice of material change
- A four-value answer scale — Yes, Some, No, N/A — with what each means and what to do next
- A red-flag table for the four issues that should stop an approval: no privacy terms or DPA, unclear data locations or sub-processors, no incident notification route, and no way to return or delete data at exit
- A decision page for the overall call, the reason, next review date and where evidence is saved, plus actions with owners and due dates and a two-line sign-off
The instruction at the top of the form is the one that matters: do not approve a vendor with an unresolved critical issue, however positive the other answers are. The form supports a practical privacy review — complex or high-risk situations still need your legal or privacy team.