When you review a vendor that will handle personal data, ask where data is stored, who can access it from where, which sub-processors are involved and what legal mechanism covers transfers. A good answer is specific, names locations and matches the contract. A vague answer is a finding.
The questions
- Where is our data stored? Look for named regions and providers, not "in the cloud".
- Where are backups, logs and analytics? The EDPB says to map where data may be located or processed.
- Who can access it, from which countries? Remote access from a third country, including support, may be a transfer.
- Which sub-processors, in which countries? Ask for the current list and the change notice process.
- What mechanism covers transfers out of the EEA? Adequacy, standard clauses or another tool, and the date of last verification.
- What technical measures apply? Encryption, key custody and field minimisation.
- Can we choose a region? And is region fixed after signup?
- What happens in an outage? Does failover cross regions?
- How do we exit? Export formats, deletion after exit, deletion proof.
- How do we hear about changes? Notice period for new regions or sub-processors.
What good looks like
- Named locations that match the data processing agreement.
- A published sub-processor list with a notice mechanism. See what to track on a subprocessor list.
- A clear description of support access and logging.
- Willingness to describe key custody if encryption is claimed. See key custody checklist.
Red flags
- "We are GDPR compliant" with no specifics.
- Marketing says EU hosting but the contract allows any region.
- Staff access from unnamed countries.
- No sub-processor list, or one that is out of date.
- Claims of encryption where the vendor holds the keys and needs readable data.
Record the outcome
Put the answers, date and reviewer in your vendor register, with a next review date. Link them to the data map entry for the vendor. See fourth party risk for the vendors behind your vendors.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the mapping and see how one piece of evidence can support several frameworks. A vendor review record can serve privacy, security and audit needs together.
Scoring the answers
Rate each question as clear, partial or missing. A few partial answers are normal. A missing answer on access from other countries or on sub-processors should block approval until it is resolved, since those are the two places where hidden transfers occur.
Contract follow up
Turn the answers into contract terms: named regions, a duty to notify before changing them, a right to object to a new sub-processor, deletion deadlines on exit and a duty to tell you if the vendor can no longer meet its commitments. Answers given only in a questionnaire are easy to lose.
Quick check
How often should we re-review?
At least yearly, and on any change notice. The EDPB expects re-evaluation at appropriate intervals.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
