What it means
Vendor privacy due diligence evaluates whether a provider’s processing, controls, governance, history, and supply chain are appropriate for the intended data and service risk.
Why it matters
A standard questionnaire can conceal material differences in access, purpose, retention, sub-processors, incident history, technical architecture, and control maturity.
Practical focus
- Tier vendors by data sensitivity, processing role, scale, criticality, integration, geography, and ability to affect individual rights.
- Collect evidence about purpose, data flows, access, security, retention, deletion, rights support, incidents, sub-processors, transfers, and assurance.
- Resolve gaps through design change, contractual commitments, compensating controls, monitoring, acceptance, or rejection.
- Preserve this evidence: Retain the risk tier, questionnaire, supporting evidence, analysis, exceptions, approvals, contract requirements, and ongoing monitoring plan.
- Exercise this failure scenario: A low-scrutiny vendor gains production access to sensitive data and later cannot support deletion, investigation, or breach notification obligations.
Common mistakes
- Using the label Vendor Privacy Due Diligence without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that Vendor Privacy Due Diligence operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A low-scrutiny vendor gains production access to sensitive data and later cannot support deletion, investigation, or breach notification obligations.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: