A right to audit clause gives you a contractual way to check that a vendor does what it promised. Ask for it, but scope it: accept independent reports for routine checks, keep on-site or technical inspection for cause, and agree notice, frequency, confidentiality and cost in advance.
What the law says in one case
GDPR Article 28(3)(h) requires a processor contract to say the processor makes available all information needed to demonstrate compliance and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates. So for personal data processing, an audit right is part of the required content, not a bonus. This is a summary, not legal advice.
What you actually want
Most buyers do not want to walk through a vendor's data center. They want assurance that controls work. There are three levels:
- Documents. Independent reports, certificates, penetration test summaries and policies.
- Remote review. Questionnaire follow-up, screen shares, evidence samples.
- Inspection. On-site or technical access to systems, usually for cause.
Clauses to request
- Scope. What can you examine: facilities, systems, records, staff interviews?
- Notice. Reasonable advance notice, such as thirty days, shorter after an incident.
- Frequency. Once a year at most for routine reviews, plus after a breach or major finding.
- Substitute reports. The vendor may satisfy routine requests by providing a current independent report that covers the relevant controls.
- Confidentiality. Auditors sign confidentiality terms. The vendor may exclude other customers' data.
- Auditor choice. You may use a third party, but not a direct competitor of the vendor.
- Remediation. The vendor fixes findings within an agreed time and reports back.
- Cost. Each side pays its own costs unless the audit finds material breach.
Why vendors push back
Multi-tenant vendors cannot let every customer into shared systems. That is reasonable. Meet them halfway: accept the independent report as the normal route and reserve inspection for serious cause. Most mature vendors agree to this shape.
Using the right well
- Ask first for the report and read it. See how to read a SOC 2 report.
- Ask specific, evidence-based questions, not a general fishing trip.
- Keep an audit calendar for critical vendors only.
- Record outcomes and follow up on findings.
When the vendor will not agree
For a low-risk vendor, you may accept no audit right and rely on public reports. For a critical vendor handling sensitive data, a refusal should be escalated to legal and recorded as an accepted risk with a named owner.
Quick check
Is a SOC 2 report a replacement for a right to audit?
For routine checks, often yes. Keep the right for cause, such as a breach or a major exception.
Does every vendor need an audit clause?
No. Focus on critical vendors and those that process personal data on your behalf.
Sources
Last reviewed: 19 October 2026.
