GDPR vendor assessment. A practical questionnaire.

DIRECT ANSWER

A GDPR vendor assessment combines a structured intake form, DPA review, mapping of hosting and access, international-transfer analysis, documentary security review and a recorded risk decision with corrective actions.

ReviewDocumentary

No penetration testing

DecisionRisk based

Accept, remediate, reject

FormatPDF

Downloadable questionnaire

Vendor intake

Service and purpose

Describe the service, affected individuals, data categories and intended purpose.

Role and instructions

Identify the role and confirm processing on behalf of the customer is limited to documented instructions.

Lifecycle

Document collection, access, support, backup, retention, return and deletion.

Contract and processing chain

Article 28

Review mandatory terms, assistance, audit rights, confidentiality and security obligations.

Subprocessors

Obtain the list, locations, functions and change-notification mechanism.

Termination

Choose return or deletion and document justified retention exceptions.

Security, transfers and decision

Security evidence

Review policies, certifications, available tests, access management, incident handling and continuity.

Transfers

Identify access outside the EEA and assess the required transfer mechanism and safeguards.

Decision

Record risks, acceptance conditions, actions, owners, deadlines and review date.

Move from checklist to a documented decision

Match assessment depth to vendor risk

Classify the provider by data type, access, criticality, volume, affected individuals and how difficult the service would be to replace. A tool receiving no personal data does not require the same review as a hosting provider, HR platform or support service with administrative access. Keep the rationale for the selected review tier.

This avoids two common failures: sending the longest questionnaire to every supplier or accepting a self-declaration for critical services. Define review levels with minimum evidence, an approver, a validity period and clear reassessment triggers.

Read the DPA and security evidence together

The DPA should reflect the actual service, including instructions, confidentiality, measures, assistance, audit rights, subprocessors, termination and transfers. Compare material clauses with questionnaire answers and technical documents. An inconsistency should become a follow-up question, corrective action or acceptance condition rather than disappearing into a total score.

Security review remains documentary. It may examine control descriptions, independent reports, policies or available test results without concluding that no vulnerability exists. Higher-risk engagements may require a cybersecurity specialist to perform technical testing against an agreed scope.

Record the decision and monitor the relationship

The useful output is more than a score. It states the risks, blocking gaps, compensating controls, actions, owners and deadlines. Leadership or the designated risk owner accepts, rejects or conditions the provider under internal governance; the DPO or privacy adviser informs that decision.

After onboarding, monitor changes to subprocessors, locations, purposes, incidents and contractual terms. Reassessment frequency should be risk based. The RGPD Conseil Maroc review described here does not include complex legal negotiation, penetration testing or certification of the vendor.

Get the PDF version

Receive the PDF template for an initial documentary assessment.

Frequently asked questions

Can a vendor simply state that it is GDPR compliant?+

No. The decision should rely on information and evidence proportionate to the risk.

Does every vendor require the same assessment?+

No. Depth should reflect data sensitivity, access, criticality and service risk.

Is ISO certification enough?+

No. It may be useful evidence but does not alone satisfy contractual and transfer requirements.

Does RGPD Conseil Maroc perform penetration tests?+

No. This is a documentary review; deep technical testing requires a qualified cybersecurity specialist.

When should the assessment be repeated?+

After material changes, incidents, contract changes or at a risk-based interval.

EDPB - Controller and processor conceptsGDPR, Article 28

This guide provides a general framework and does not replace an assessment of your circumstances or reserved legal advice.

Outsource a vendor review

RGPD Conseil Maroc converts the responses into a documented decision and remediation plan.

A GDPR vendor questionnaire organises a review; it does not establish compliance by itself. Material answers should point to a document or a verifiable control. Uncertainty should be recorded as an open question with an owner and a follow-up date.

Choose the right depth

Payroll software and a scheduling tool do not necessarily require the same review depth. Start with service type, data, access and criticality, then explain the evidence requested. A proportionate questionnaire is easier to complete and evaluate than an exhaustive list disconnected from the service.

Answer without overpromising

Distinguish implemented, partially implemented, planned and not applicable, with reasons. Have the operating team check technical answers. An available software feature is not necessarily an enabled control. Sales commitments should remain consistent with contracts and actual practice.

Protect shared evidence

Share necessary evidence through an appropriate channel with limited recipients. Remove names, customer records and technical secrets that do not help the review. A redacted extract or controlled demonstration may be preferable to a full document. Retain the submitted response version so changes can be explained at renewal.

Document the decision

The buyer should be able to identify blocking gaps, proposed measures and required approvals. Prepare an action table rather than an unexplained score. The designated owner accepts or rejects risk within their organisation. RGPD Conseil Maroc can structure the documentary review and follow-up questions as a per-vendor engagement.

Illustrative example: a SaaS supplier answers “encrypted backups”. Before submission the team checks whether this configuration covers the environment being sold. If it covers only part of the service, the answer should identify that boundary and the remediation plan.

Your starting dossier

• Service and risk level
• Answers linked to evidence
• IT and business validation
• Decision, actions and review date

Describe the situation without submitting customer records, passwords or confidential documents in the initial form.

Practical questions

What should I prepare before contacting RGPD Conseil Maroc?

Prepare: Service and risk level; Answers linked to evidence; IT and business validation; Decision, actions and review date. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.

Does an introductory call replace the engagement?

No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.

Download the
full checklist.

The same checklist as a one-page PDF. Download the vendor questionnaire (PDF) ↓

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• DPA, SCCs and TIA: which transfer documents do you need?
• When is a DPIA required?
• EU hosting with overseas support: GDPR access checks