# Vendor assessment checklist

PrivacyBuilt Editorial

A working starting point for global organisations. Adapt to the processing, role and relevant law; this is educational guidance, not legal advice or a compliance determination.

- [ ] Identify service scope and controller/processor roles for each activity.
- [ ] Map data categories, people affected and processing purposes.
- [ ] Identify hosting locations, subprocessors and onward recipients.
- [ ] Check applicable contractual and international-transfer requirements.
- [ ] Request proportionate security and assurance evidence.
- [ ] Review retention, deletion, return and exit arrangements.
- [ ] Agree incident reporting and response responsibilities.
- [ ] Check support for rights requests and audit obligations.
- [ ] Record risks, evidence gaps and required contractual actions.
- [ ] Assign approval authority, remediation owners and a reassessment date.

## Review record

Owner:
Scope:
Evidence references:
Open questions:
Decision and conditions:
Next review:

Avoid entering personal data, credentials or confidential source material in public tools.