Back to Module
1 of 3|Privacy Operations
video 15 min•Compliance Monitoring
Vendor Assessment
How to ensure third parties are compliant.
🎯 Learning Objectives
- ▸ Understand the vendor onboarding process
- ▸ Learn what security and privacy questions to ask
The Vendor Assessment Questionnaire
Before you give a vendor access to personal data, you must assess them. A standard vendor assessment questionnaire covers:
- • What personal data will the vendor access?
- • Where will the data be stored?
- • What security measures (encryption, access controls) are in place?
- • Who has access to the data within the vendor organization?
- • Does the vendor use sub-processors?
- • How does the vendor handle data breaches?
If a vendor cannot answer these basic questions or refuses to provide evidence, it is a red flag. Do not share data with them.
📖 Glossary
- Vendor Assessment
- The process of evaluating a third-party's security and privacy practices before engaging them.
- ISO 27001
- An international standard for information security management systems.
🔑 Key Takeaways
- Never onboard a vendor without a privacy assessment.
- Request security certifications (ISO 27001, SOC 2).
- Review the vendor's privacy policy and sub-processor list.
📚 Further Reading
- DPDPA Section 8(2) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...