Vendor Assessment Questionnaire
A 40-question vendor privacy assessment covering data processing practices, security controls, sub-processors, breach notification procedures, and regulatory certifications.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- Send the questionnaire to the vendor during procurement, before any contract is signed. The answers are an input to the DPA and the risk acceptance decision.
- Have the vendor complete sections 1–6 (processing scope, security measures, sub-processors, transfers, breach notification, DPDP/GDPR obligations) and attach the supporting documents named in each section.
- Score the response against your risk thresholds. The template includes a scoring rubric that converts textual answers into a 0–3 risk score per section.
- Where the response falls below threshold, require a remediation plan or reject the vendor. Where it passes, store the completed questionnaire alongside the executed DPA for the full lifetime of the vendor relationship.
- Re-run the questionnaire annually and after any material change — new sub-processor, new processing location, new security incident at the vendor.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Is this SIG-aligned?+
The questionnaire reuses large parts of the Standardized Information Gathering questionnaire's privacy sections, so a vendor who's completed SIG can transpose their answers. We've deliberately kept it tighter — SIG is 500+ questions, this is ~60.
Can we use this for intra-group vendors?+
Yes. Intra-group processors still need DPAs, and the questionnaire is a quick way to collect the Annex 1 inputs for the DPA from each group entity.
What about ISO 27001 / SOC 2 reports — do they replace the questionnaire?+
They cover the security domain. The questionnaire covers privacy specifics — lawful basis, retention, DPO details, data subject rights workflow — that SOC 2 and ISO 27001 don't address. Accept the reports as supporting evidence; don't accept them in lieu of the questionnaire.
What's the right threshold for rejection?+
A vendor scoring below 2.0 (out of 3) on average is a soft reject — require remediation. Any single critical-section fail (sub-processor transparency, breach notification, data location) is a hard reject regardless of the overall average.
How do we track outstanding responses?+
Add the vendor to your vendor register with a status flag (Pending / Received / Approved / Rejected) and a review date. TruePrivacy's vendor risk platform runs this register automatically with reminders.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes