COMPLIANCE

Vendor Due Diligence — Data Processor

Pre-contract due diligence on a prospective data processor. Ensures Article 28 requirements are met before sharing any personal data.

Tasks
15
Span
26d
Use this template in Dorift Download for Android Download as JSON

Tasks in this template

  1. 1
    Request the vendor's public privacy policy and security overview D+1
  2. 2
    Request and review the Article 28 data processing agreement (DPA) D+2

    Article 28(3): the DPA must specify subject matter, duration, nature and purpose, type of personal data, categories of data subjects, and the controller's obligations and rights.

  3. 3
    Review the DPA against internal DPA standards and redline deviations D+3
  4. 4
    Request the list of sub-processors and geographic locations D+5

    Article 28(2) & (4): general written authorisation required for sub-processors, with the right to object. Sub-processors must be bound by equivalent obligations.

  5. 5
    Assess international transfer mechanism (SCCs, adequacy, BCRs) D+7

    If transfers outside the EEA are involved, confirm a valid Chapter V transfer tool and conduct a transfer impact assessment.

  6. 6
    Review technical and organisational measures against Article 32 D+9

    Article 32(1): appropriate measures considering state of the art, costs, and the risk of varying likelihood and severity. Evaluate pseudonymisation, encryption, resilience, and regular testing.

  7. 7
    Review the breach notification process and timelines D+11

    Article 33(2): the processor must notify the controller without undue delay after becoming aware of a breach. Define timelines contractually.

  8. 8
    Review retention, return, and deletion procedures at end of contract D+13
  9. 9
    Request certifications: ISO 27001, SOC 2, ISO 27701, sector-specific D+14
  10. 10
    Review latest penetration test summary and SOC 2 report D+16
  11. 11
    Review business continuity and disaster recovery posture D+18
  12. 12
    Conduct or update the Data Protection Impact Assessment if needed D+20

    Article 35: if processing is likely to result in a high risk, DPIA must be performed before relying on the vendor.

  13. 13
    Obtain internal stakeholder sign-off (DPO, Security, Legal) D+22
  14. 14
    Finalise and execute the DPA and MSA D+24
  15. 15
    Register the vendor in the Article 30 RoPA as a processor D+26
← Back to Dorift