Answering customer security questionnaires that ask about GDPR

When a customer's security questionnaire asks about GDPR, answer in terms of roles, records and controls: whether you act as controller or processor, what contract terms you accept, how you secure and report on personal data. Do not claim "GDPR certified" unless you can name the exact certification scheme you hold. The regulation itself sets obligations, not a badge.

Which GDPR questions come up most?

Most questionnaires map to a handful of articles. Using them as a skeleton keeps answers consistent.

Role (Article 4). Article 4 defines controller as the party that determines the purposes and means of processing, and processor as the party that processes on the controller's behalf. Say which you are for the service being bought. Many vendors are processors for customer data and controllers for their own account and billing data.

Processor terms (Article 28). A controller may use only processors that provide sufficient guarantees, and processing must be governed by a contract that sets out subject matter, duration, nature and purpose of processing, type of personal data and the controller's instructions. Customers will ask for a data processing agreement and a list of sub-processors.

Principles (Article 5). Lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Expect questions on retention periods and deletion.

Records (Article 30). Controllers and processors keep records of processing activities. Be ready to say that you maintain them.

Security (Article 32). Appropriate technical and organizational measures, taking account of risk. The article gives examples such as pseudonymization and encryption, ongoing confidentiality and integrity, the ability to restore availability, and regular testing of effectiveness.

Breach notification (Article 33). A controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. A processor must notify the controller without undue delay. Customers will ask for your processor notification commitment in hours.

How should I word the answers?

Be specific and short. Compare:

Weak: "We are fully GDPR compliant." Better: "We act as processor for customer content under a data processing agreement. We maintain records of processing, list our sub-processors, and commit to notifying you of a personal data breach without undue delay."

The second is checkable, which is what a reviewer wants. Claim only what you can attach evidence for. If something is in progress, say it is in progress, with the date you will update. If a certification such as SOC 2 Type II is underway, say it is underway and do not describe it as complete. The same discipline applies to regional or government frameworks that you target but have not been assessed against.

What evidence should I attach?

• Your data processing agreement template and sub-processor list.
• Your record of processing activities summary.
• A security overview mapped to Article 32 measures.
• Your incident response and breach notification procedure.
• Retention and deletion policy, with how deletion requests are handled.
• Data location statements per service, if you can state them accurately.

What to do

1. Decide and document your role for each service you sell.
2. Prepare a standard DPA and sub-processor list and keep both current.
3. Write a one page Article 32 summary of your technical and organizational measures.
4. Document your breach notification commitment and test the process once a year.
5. Create an answer library with approved wording, dates and evidence links.
6. Have legal review any phrase that says "compliant", "certified" or "guaranteed."

Quick check

Sources

• GDPR Article 4, Definitions
• GDPR Article 5, Principles
• GDPR Article 28, Processor
• GDPR Article 30, Records of processing activities
• GDPR Article 32, Security of processing
• GDPR Article 33, Notification of a personal data breach

Last reviewed: 18 October 2026.