Vendor assessment procedure: what the decision maker looks at

Vendor assessment procedure follows a fixed sequence: intake, document review, risk scoring, decision, and, where the vendor processes data, a written record. The decision maker looks at four things: what data the vendor touches, where it is hosted, who at the vendor is accountable, and what happens if the vendor is breached.

The decision maker is rarely a single person. In most organisations it is a small committee: someone from data protection, someone from procurement, and someone who owns the business relationship. Each of the three signs off separately, and the file is not closed until all three signatures are present.

What the decision maker checks first

The first pass is document-based, not conversational. The decision maker asks for a security questionnaire, a data processing description, and, if the vendor supplies licensed software or content, proof that the licence is properly held and recorded. Where a licence has changed hands, the recordal itself becomes part of the file: see Recordal of a licence for how that step is checked on its own.

Only after the documents are in does the decision maker look at substance: sub-processors, storage location, retention period, and the vendor's own incident history if disclosed. A vendor that cannot produce a sub-processor list is treated as high risk regardless of what the questionnaire says.

Stages of the procedure

The table below sets out the stages as they typically run, in order. Duration is indicative and depends on how complete the vendor's own documentation is at intake.

The contract stage is where most delay happens. If the vendor's own terms conflict with the client's security requirements, the two sides negotiate a separate annex rather than amend the main agreement. How that review is done in practice, clause by clause, is set out in How contract review against a security annex technology contract.

Who decides and how long it takes

Formal sign-off sits with the committee described above, not with the business owner who wanted the vendor in the first place. That separation exists precisely so that commercial pressure does not override a security concern.

A straightforward assessment, where the vendor answers promptly and the documents are complete, closes within four to six weeks from intake to decision. A vendor that handles a narrow, low-sensitivity function can move faster; a vendor that will hold personal data at scale, or that sits outside the client's usual jurisdictions, takes longer because the risk scoring stage has more to weigh.

If the vendor does not respond, or the file raises a conflict

Two situations account for most stalled files.

The first is silence. If the vendor does not answer the questionnaire within the agreed window, the decision maker does not chase indefinitely. A second written request is sent with a fixed deadline, and if that deadline passes too, the file is marked as rejected on the ground of incomplete information, not on the merits.

The second is a physical-goods vendor whose shipment gets held at a border. This is not a data protection question, but it changes the assessment timeline because the decision maker cannot verify hardware without the unit itself. The mechanics of that separate problem are covered in When a customs authority detains a shipment: when the.

A third, less common situation arises inside the client's own team: someone on the assessment committee has a personal or financial connection to the vendor under review. That is handled by disclosure and recusal, following the same logic used for any internal conflict, described in Conflict of interest register token issuance what the decision.

What this procedure does not cover

This page describes the assessment itself, not what follows once a vendor is approved. It does not cover ongoing monitoring after sign-off, breach notification once the vendor is live, or the pricing terms of the underlying contract. It does not tell you which specific security controls a regulator will accept as sufficient; that judgement is fact-specific and belongs in the file review, not on a general procedure page.

If the assessment surfaces a question that a supervisory authority is likely to ask about later, that correspondence follows its own separate track. See Supervisory correspondence: what the decision maker looks at for how that exchange is handled once it starts.

Sources and limits

This page describes procedure only: who decides, in what order, and within what timeframe. It does not cite statutory articles or specific regulatory text, because the underlying national implementing rules for this file are not yet confirmed in our records. Where a specific legal obligation applies to your vendor and your jurisdiction, that question needs a separate, sourced answer rather than a general procedure page.

Checked: this description reflects how the procedure typically runs in practice and is reviewed periodically for accuracy.

FAQ

How long does vendor assessment procedure take in practice?
Four to six weeks from intake to decision is typical, assuming the vendor responds promptly and the file is complete. A vendor with a large sub-processor chain or an unfamiliar jurisdiction takes longer.

Which documents are needed to start?
A security questionnaire, a description of the data the vendor will process, and a sub-processor list. Contract terms and any security annex are reviewed once these three are in.

What happens if the other side does not respond?
A second written request with a fixed deadline is sent. If that deadline passes without a reply, the file is closed as rejected for incomplete information, not assessed on its merits.

— Rasa Tumenaite, AURELIS