Ask for the right to review evidence of how the vendor handles your data, such as independent audit reports, policies and answers to a questionnaire, with on-site inspection reserved for cause. The GDPR expects processors to make available information needed to show compliance and to allow audits. Aim for a realistic process. This is not legal advice.
What the GDPR says
Article 28 requires that a processor contract stipulate that the processor makes available all information necessary to demonstrate compliance with the Article and allows for and contributes to audits, including inspections, conducted by the controller or another auditor mandated by the controller. That sets a floor for personal data. It does not tell you how to run it. Contracts fill the gap.
A ladder of audit options
| Level | What you get | When it fits |
|---|---|---|
| 1. Public documentation | Trust page, policies, sub-processor list | First screening |
| 2. Independent reports and summaries | Audit reports under NDA, penetration test summaries | Standard for most buyers |
| 3. Written questionnaire | Answers to your specific questions, signed off | Gaps left by level 2 |
| 4. Remote review | Video walkthrough of controls, screen share of evidence | Higher risk or regulated buyers |
| 5. On-site inspection | Visit to the vendor, usually limited in frequency | After an incident, regulator request, or serious concern |
Most agreements land on levels 2 and 3 by default, and level 5 for cause.
What to put in the clause
- Frequency. Once a year without cause, more often after a breach or regulator request.
- Notice. A reasonable number of days, so the vendor can prepare.
- Scope. Systems and processes that handle your data, not the whole company.
- Confidentiality. You protect what you see, and use auditors under NDA.
- Cost. Who pays. A common compromise is that each side bears its own costs unless the audit finds a material issue.
- Remediation. The vendor fixes findings within an agreed time and reports back.
- Sub-processors. The vendor passes on equivalent rights or provides their reports.
What vendors reasonably push back on
Multi tenant vendors cannot let every customer walk through shared systems. Expect them to prefer independent reports and remote reviews to protect other customers' data. That is fair. Your leverage is in clear scope and the for cause exception.
Be careful of unlimited rights nobody will use. A narrow right you exercise beats a broad one you only negotiate.
Make the evidence useful
Ask the vendor what evidence it holds for your data handling questions: access logs, deletion records, change records. Evidence that exists can be shown quickly. If you also keep your own records, such as sub-processor reviews and access reviews, the audit is easier from both sides. See a customer wants to audit you: how should a SaaS vendor respond for the vendor view.
Try it yourself
Click through it at your own pace, or open it full screen. See how controls map to framework requirements, which is the kind of mapping an audit asks you to show.
How Safeguard fits
Safeguard offers compliance and evidence automation, which helps collect records that audits ask for. You can see the free scan before engaging.
Quick check
Can I demand an on-site audit of a SaaS vendor?
You can ask. Many vendors limit it to for cause cases and offer reports and remote review otherwise.
Do audit reports replace my own review?
No. They show what an auditor tested within a scope. Read the scope and period to see whether it covers your use.
Sources
Last reviewed: 19 October 2026.
