Vendor Data Processing Review Checklist
Check a supplier before sharing personal data.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Create a checklist for reviewing a vendor that will process personal data for us. Type of vendor and data: [VENDOR_DATA]. Where the vendor operates: [VENDOR_LOCATION]. Our role in the data relationship: [OUR_ROLE]. List questions grouped by purpose and instructions, security measures, subprocessors, location and transfers, breach notice, individual rights support, return and deletion, audits, and contract terms. For each question add what a good answer looks like and a red flag. Provide a scoring table and a rule for what risk level requires management sign-off. Mark transfer and contract requirements [VERIFY] with legal counsel in [JURISDICTION]. Do not draft contract text. Add a section describing how to record the review outcome, including residual risks accepted and by whom, and a re-review schedule based on risk. Provide a template email to send to the vendor with the questions, requesting responses in two weeks, and a plan for what to do when a vendor refuses to answer. Please keep the output protective and non-operational: policies, checks, user training and incident handling, not tools for intrusion.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.