Skip to content
SERVICES
Vendor & third-party privacy risk
Data protection due diligence before onboarding a provider and throughout the relationship.
When is this service relevant?
When a provider will access personal data, engage subprocessors, change processing locations or propose standard data protection terms.
Scope of support
- Determination of the parties’ roles: processor, independent controller or joint controller.
- Preparation of due diligence questionnaires and assessment of responses and supporting evidence.
- Review of technical and organisational measures, audit reports and the scope of certifications.
- Assessment of subprocessor chains, locations, remote access and transfers outside the EEA.
- Review of DPA terms on incidents, rights assistance, audit rights, deletion and return of data.
- Reasoned risk assessment, outstanding questions and criteria for reassessment.
The service covers privacy and data protection risks. Wider financial, operational and technical security audits require a separate scope.