Vendor assessment procedure: documents to prepare
Onboarding a vendor that will touch personal data or connect to your systems is a documentary exercise before it is a negotiation. The procedure asks for a fixed set of records — a data flow description, a completed security questionnaire, a sub-processor list, a draft security annex — before any system access is granted. Assemble the file first; the conversation with the vendor runs faster once it exists, and stalls without it.
What changes once assessment starts
Before the file is open, the vendor is a candidate and nothing has been shared. Once the vendor receives the questionnaire, the clock on the relationship starts, even if no contract exists yet. Access granted before the file is complete is the point of no return: reversing it means an incident review, not a paused procedure. Treat every stage as reversible until the vendor is given a working account, a test dataset, or a live connection.
The risk is asymmetric. A vendor that fails the questionnaire but has already received a sample export cannot be un-onboarded by deleting the export request. Keep the sequence strict: document review first, access second, never the reverse.
Documents to prepare, by stage
The file grows in three stages. Each stage produces documents the next stage needs; skipping a stage means redoing work later, not saving time.
| Stage | Document | Prepared by |
|---|---|---|
| Screening | Data flow description: what personal data, in what volume, for what purpose | Business owner of the engagement |
| Screening | Vendor security questionnaire, completed and signed by the vendor | Procurement, sent to the vendor |
| Assessment | Sub-processor list, current at the date of review | Vendor, verified by IT security |
| Assessment | Evidence of certifications and past incident disclosures | IT security |
| Closing | Draft data processing annex reflecting the assessment outcome | Legal |
| Closing | Sign-off record: proceed, escalate, or decline | Data protection lead |
Where the vendor's offering rests on technology it licenses rather than owns, add one further document: evidence that the licence covers the use you intend. A licence that was never recorded is difficult to rely on later — see Recordal of a licence before you accept the vendor's word for it.
What to do
- The business owner drafts the data flow description before the vendor is contacted.
- Procurement sends the security questionnaire and sets a response deadline in the request itself.
- IT security checks the returned questionnaire against the vendor's certifications and any public incident history.
- Legal drafts the security annex once the questionnaire is verified, not before.
- Where the arrangement touches a technology contract already in place, route the annex through the same check the wider agreement received.
- The data protection lead signs off the file: proceed, escalate to committee, or decline.
How contract review against a security annex technology contract sets the pattern for that check, including who signs off the annex before it reaches the vendor.
Who decides
The data protection lead decides routine cases alone. A case escalates to committee when the vendor processes special categories of data, sits outside the EU or EEA, or refuses to complete the questionnaire in the form requested. The committee's decision is recorded in the same file, not in a separate memo.
Committee composition needs its own check. Where a member has a personal or financial stake in the vendor under review, that stake belongs in a separate record before the committee sits — the pattern is the same one used for Conflict of interest register: documents to prepare. Skipping that record does not remove the conflict; it removes the evidence that the conflict was managed.
In practice, a complete file with no escalation triggers moves from questionnaire to sign-off within one to two weeks. Escalated files take longer, because the committee meets on a schedule, not on demand.
Where the procedure forks
If the vendor is a sub-processor acting for another vendor already under contract, the file needs the upstream vendor's sub-processor register as well as the new vendor's own questionnaire. Two files, not one, even where the underlying data flow looks identical.
If the vendor processes special categories of data or a large volume of records, add a deeper risk screening before the draft annex is written. The screening result, not the questionnaire alone, decides whether the file proceeds.
If the vendor uses the assessment conversation to offer you a separate transaction — most often an offer to sell rights it holds rather than licence them — stop and treat that offer on its own track. It is a different procedure with a different decision point; see When a patent is offered to you for sale for what changes before the assessment file absorbs a transaction it was never built to hold.
Limit
This page does not decide whether a given vendor should pass assessment. It does not draft the security annex or the questionnaire itself, and it does not cover what happens once an incident has already occurred at a vendor already under contract. It describes the sequence and the documents; the substantive risk call sits with the data protection lead and, where escalated, with the committee.
Related publications
The file built here often runs alongside correspondence with a supervisory authority, particularly where the vendor relationship is under review for an unrelated reason. See How supervisory correspondence data protection documents to prepare runs for the parallel file.
Verified
This page reflects internal procedural practice as applied at the date of publication. It does not cite specific statutory deadlines, because none is fixed for this stage of the file. The timing figures above describe typical practice, not a legal requirement, and are reviewed for currency in the course of ordinary file maintenance.
Frequently asked questions
How long does vendor assessment procedure take in practice?
A complete file with no escalation moves from questionnaire to sign-off in one to two weeks. Escalation to committee adds time because the committee sits on a schedule rather than on demand; a decision can take several additional weeks depending on when the next meeting falls.
Which documents are needed to start?
Two documents open the file: the data flow description, prepared internally before the vendor is contacted, and the security questionnaire, sent to the vendor with a stated response deadline. Nothing else is needed to begin; the remaining documents follow once the vendor responds.
What happens if the other side does not respond?
A questionnaire without a response by the stated deadline is a decision point, not a delay to wait out. Procurement records the non-response in the file, and the data protection lead either extends the deadline once, in writing, or closes the file as declined. Silence does not extend the deadline on its own.