RCM
No penetration testing
QUESTIONNAIRE · GDPR VENDOR REVIEWGDPR vendor assessment.
GDPR vendor assessment.
A practical questionnaire.
Vendor due diligence is not satisfied by asking whether a provider is GDPR compliant. Review the role, data, contract, access, locations, subprocessors and available security evidence.
A GDPR vendor assessment combines a structured intake form, DPA review, mapping of hosting and access, international-transfer analysis, documentary security review and a recorded risk decision with corrective actions.
Accept, remediate, reject
Downloadable questionnaire
Vendor intake
Service and purpose
Describe the service, affected individuals, data categories and intended purpose.
Role and instructions
Identify the role and confirm processing on behalf of the customer is limited to documented instructions.
Lifecycle
Document collection, access, support, backup, retention, return and deletion.
Contract and processing chain
Article 28
Review mandatory terms, assistance, audit rights, confidentiality and security obligations.
Subprocessors
Obtain the list, locations, functions and change-notification mechanism.
Termination
Choose return or deletion and document justified retention exceptions.
Security, transfers and decision
Security evidence
Review policies, certifications, available tests, access management, incident handling and continuity.
Transfers
Identify access outside the EEA and assess the required transfer mechanism and safeguards.
Decision
Record risks, acceptance conditions, actions, owners, deadlines and review date.
IMPLEMENTATION GUIDE
Move from checklist to a documented decision
Match assessment depth to vendor risk
Classify the provider by data type, access, criticality, volume, affected individuals and how difficult the service would be to replace. A tool receiving no personal data does not require the same review as a hosting provider, HR platform or support service with administrative access. Keep the rationale for the selected review tier.
This avoids two common failures: sending the longest questionnaire to every supplier or accepting a self-declaration for critical services. Define review levels with minimum evidence, an approver, a validity period and clear reassessment triggers.
Read the DPA and security evidence together
The DPA should reflect the actual service, including instructions, confidentiality, measures, assistance, audit rights, subprocessors, termination and transfers. Compare material clauses with questionnaire answers and technical documents. An inconsistency should become a follow-up question, corrective action or acceptance condition rather than disappearing into a total score.
Security review remains documentary. It may examine control descriptions, independent reports, policies or available test results without concluding that no vulnerability exists. Higher-risk engagements may require a cybersecurity specialist to perform technical testing against an agreed scope.
Record the decision and monitor the relationship
The useful output is more than a score. It states the risks, blocking gaps, compensating controls, actions, owners and deadlines. Leadership or the designated risk owner accepts, rejects or conditions the provider under internal governance; the DPO or privacy adviser informs that decision.
After onboarding, monitor changes to subprocessors, locations, purposes, incidents and contractual terms. Reassessment frequency should be risk based. The RCM review described here does not include complex legal negotiation, penetration testing or certification of the vendor.
PDF · PRACTICAL RESOURCE
Get the PDF version
Receive the PDF template for an initial documentary assessment.
FAQ
Frequently asked questions
Can a vendor simply state that it is GDPR compliant?+
No. The decision should rely on information and evidence proportionate to the risk.
Does every vendor require the same assessment?+
No. Depth should reflect data sensitivity, access, criticality and service risk.
Is ISO certification enough?+
No. It may be useful evidence but does not alone satisfy contractual and transfer requirements.
Does RCM perform penetration tests?+
No. This is a documentary review; deep technical testing requires a qualified cybersecurity specialist.
When should the assessment be repeated?+
After material changes, incidents, contract changes or at a risk-based interval.
This guide provides a general framework and does not replace an assessment of your circumstances or reserved legal advice.
RCM
Explore vendor review services →Outsource a vendor review
RCM converts the responses into a documented decision and remediation plan.
A GDPR vendor questionnaire organises a review; it does not establish compliance by itself. Material answers should point to a document or a verifiable control. Uncertainty should be recorded as an open question with an owner and a follow-up date.
Choose the right depth
Payroll software and a scheduling tool do not necessarily require the same review depth. Start with service type, data, access and criticality, then explain the evidence requested. A proportionate questionnaire is easier to complete and evaluate than an exhaustive list disconnected from the service.
Answer without overpromising
Distinguish implemented, partially implemented, planned and not applicable, with reasons. Have the operating team check technical answers. An available software feature is not necessarily an enabled control. Sales commitments should remain consistent with contracts and actual practice.
Protect shared evidence
Share necessary evidence through an appropriate channel with limited recipients. Remove names, customer records and technical secrets that do not help the review. A redacted extract or controlled demonstration may be preferable to a full document. Retain the submitted response version so changes can be explained at renewal.
Document the decision
The buyer should be able to identify blocking gaps, proposed measures and required approvals. Prepare an action table rather than an unexplained score. The designated owner accepts or rejects risk within their organisation. RCM can structure the documentary review and follow-up questions as a per-vendor engagement.
Practical questions
What should I prepare before contacting RCM?
Prepare: Service and risk level; Answers linked to evidence; IT and business validation; Decision, actions and review date. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.
Does an introductory call replace the engagement?
No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.
Official sources
General information guide. Engagement scope and applicable requirements are assessed for your circumstances.
YOUR NEXT STEP
Review my vendor questionnaire
Tell us about your business, requirements and deadline. We will help define the scope before you commit.