GDPR Vendor Risk Assessment Form
Share information about the vendor’s personal-data processing practices to support a privacy risk assessment.
Vendor and Service
Vendor name
*
Service or product provided
*
Personal data categories processed
*
Contact details
Account or user identifiers
Usage or interaction data
Employment-related data
Other personal data
Categories of people whose data is processed
*
Customers or clients
Employees or contractors
Prospective customers or applicants
Business contacts
Other groups
Purpose of processing
*
Processing and Oversight
Countries or regions where personal data is stored or accessed
*
Does the vendor use subprocessors to process personal data?
*
Yes
No
Unknown
Safeguards and Response
How are these safeguards addressed?
*
Rows
Implemented
Partially implemented
Not implemented
Unknown
Access to personal data is limited to authorized personnel
1
2
3
4
Personal data is protected during storage and transmission
5
6
7
8
Security practices are reviewed periodically
9
10
11
12
How would you rate the vendor’s readiness to identify and respond to a personal-data incident?
*
Low readiness
1
2
3
4
High readiness
5
1 is Low readiness, 5 is High readiness
What is the planned retention period for personal data?
*
Please Select
Less than 30 days
30–90 days
3–12 months
More than 12 months
Until the service ends
Unknown
Submit assessment
Should be Empty: