Vendor Privacy Risk Assessments: Diligence That Works

The obligations converge from every regime. GDPR Article 28(1): controllers shall use only processors providing sufficient guarantees to implement appropriate technical and organizational measures, a due-diligence duty that exists before the contract and continues through the relationship (the EDPB's controller-processor guidelines read it as ongoing verification, not a signing formality), and Article 28(3) mandates the contract terms: processing only on documented instructions, confidentiality commitments, Article 32 security, subprocessor authorization with flow-down of the same obligations, assistance with data subject rights and with the controller's Articles 32-36 duties (security, breach, DPIA), deletion or return at end of engagement, and audit and inspection rights; Article 82 then makes the liability joint toward individuals, and enforcement practice fines controllers for choosing or supervising processors badly. US state laws build the same machine differently: CCPA's service-provider construct exempts disclosures from 'sale' only if the contract restricts use to specified purposes, and the CPPA's regulations and enforcement (the Sephora settlement's contract findings, the CPPA's 2024-2025 sweeps) treat missing contract terms as violations by the business; Virginia, Colorado, and the rest require processor contracts with GDPR-shaped content. Sectoral overlays raise the floor: HIPAA's business associate agreements with their own mandatory clauses and OCR enforcement against covered entities for BAA failures; GLBA's Safeguards Rule requiring selection of service providers capable of maintaining safeguards, contractual requirements, and ongoing monitoring, verbatim; DORA and NIS2 in Europe adding ICT third-party risk regimes for financial and critical sectors with register, contract, and concentration-risk duties. The composite legal posture: 'we trusted the vendor' is not a defense anywhere; 'we assessed, contracted, and monitored, and here is the record' is the only shape a defense takes.

Tiering is what makes the program executable; the criteria are data and access, not spend. A workable model. Tier 1, critical: vendors processing sensitive categories (health, financial, biometric, children's), large volumes of consumer data, or with deep system access (infrastructure providers, identity platforms, anything with production credentials); diligence is full, security questionnaire (SIG or CAIQ where their standard answers are current, targeted follow-ups where they are not), independent evidence (SOC 2 Type II read, not just requested, exceptions and scope actually reviewed; ISO 27001/27701 certificates verified for scope and validity), architecture and data-flow review for the integration, transfer analysis with TIA where cross-border, negotiated DPA rather than their paper where leverage allows, and a named relationship owner. Tier 2, standard: meaningful personal data, limited sensitivity or volume; questionnaire proportionate to the integration, attestation collection with a sanity read, standard DPA terms, transfer check. Tier 3, low: minimal or no personal data (the office-plant vendor, the pure-content tool); a screening confirmation that the classification is right, terms accepted, entry in the register, and no annual re-interrogation that trains everyone to ignore the process. Mechanics that matter more than the tier labels: the classification happens at intake, in procurement's workflow, before contract, because post-signature diligence has no leverage; the questionnaire tests the integration, not the vendor in the abstract (what data, which direction, what retention, whose keys, which subprocessors touch it); evidence beats attestation wherever stakes justify it (a penetration-test summary and a SOC 2 bridge letter over a checked box); and the assessment concludes in a decision, approve, approve with conditions tracked to closure, or reject, recorded with reasoning, because an assessment file with no decision column is a survey, not a control.

The clauses whose drafting you feel during an incident, in rough order of felt pain. Breach notification: 'without undue delay' is the clause equivalent of a shrug; specify hours (24-72 from the vendor's awareness), what the notice must contain (systems, data categories, your affected population, containment status), a named channel that is monitored (not a legal-notices address), and cooperation duties including forensics access, because your own 72-hour GDPR clock and your customers' clocks run while you wait, and MOVEit-style cascades were measured in who-learned-when. Subprocessor governance: the current list as an annex or live page, advance notice of changes with a real objection window and an exit right if the objection fails, and full flow-down of the DPA's obligations, this is where fourth-party risk becomes contractually visible or invisible. Exit and deletion: return and deletion within a defined period, in usable format, with written certification and, for higher tiers, evidence (deletion logs, attestation of backup expiry), plus survival of the security and confidentiality terms until deletion completes; disputes here are routine and ugly without the clause. Audit rights sized to reality: full on-site audit rights are rarely exercised and heavily resisted; the workable ladder is annual evidence packages (SOC 2, certs, pen-test summaries), written responses to reasonable inquiries, and audit escalation triggered by incidents or evidence failures, with regulator-driven audits always preserved (Article 28(3)(h) requires the right regardless). Instructions and purpose limits: processing only on documented instructions with the purposes actually documented (the annex everyone leaves vague), no independent use, no 'service improvement' carve-outs that swallow the rule, and for US state law, the specific contractual restrictions that keep the service-provider exemption intact. Transfer terms: current mechanism (SCC modules incorporated, DPF status referenced) plus a legal-change clause obligating cooperation on replacement mechanisms, the clause that made Schrems II survivable for its holders. Liability worth arguing about: caps carved out or raised for data-protection breaches and confidentiality violations, because a general cap at fees-paid renders every other clause decorative for a vendor holding millions of records.

Onboarding answers age immediately: the vendor ships features, swaps subprocessors, gets acquired, has incidents, and lets certifications lapse, so the monitoring layer is what keeps the register true. The feeds that work. Attestation refresh on a tier-driven cadence: new SOC 2 reports read annually for Tier 1 (including the exceptions and the scope, a narrowed scope year over year is a signal), certificate validity checks, insurance certificate renewals; automate the collection, human-review the deltas. Subprocessor-change notifications routed to a decision, not an inbox: each notice triggers a lightweight review of the new party (who, where, what data), an objection where warranted within the window, and a register update, the process most programs technically have and functionally lack. Incident intelligence: security-news and breach-disclosure monitoring against your vendor list (the register's true test is whether you can answer 'do we use them?' within an hour of a headline, as everyone who lived MOVEit, SolarWinds, or the Snowflake-customer incidents learned), plus vendor-notified incidents tracked to closure with your own assessment of downstream duty (does their incident start your clocks). Access and integration drift: periodic review of what the integration actually does now, scopes granted, API permissions, data volumes, against what was assessed, because the vendor approved for logo display is now receiving the user table and nobody re-assessed. Relationship health: SLA and support performance, key-person and ownership changes (acquisitions move data across legal and sometimes national boundaries), financial-viability signals for critical dependencies (a distressed vendor cuts security spending first, and a bankrupt one auctions assets, including, sometimes, data). Offboarding as a monitored event: contract end triggers the deletion clause's execution with evidence collected and the register closed out, the step whose omission surfaces years later as data resurfacing from a vendor everyone forgot. Program instrumentation: registry coverage (vendors known vs. vendors paid, reconciled against expense and SSO data quarterly, the shadow-IT diff), assessment currency by tier, open-condition aging, and time-to-answer on the headline test.

The post-mortems repeat five lessons. Concentration risk hides in categories, not names: MOVEit (2023) compromised a file-transfer utility, and the blast radius, thousands of organizations, tens of millions of individuals, via direct use, vendors' use, and vendors' vendors' use, caught firms that had never heard of the product because it lived inside their payroll provider; the register must capture fourth-party exposure for critical categories (file transfer, identity, payments processing), which the subprocessor-flow-down clause makes knowable and most programs never query. Credentials are the perimeter: the Snowflake-customer incidents (2024) proceeded through customers' own weak authentication (credentials without MFA harvested by infostealers), not a platform vulnerability, so the assessment question is not only 'is the vendor secure' but 'is our tenancy configured to the vendor's security ceiling', shared-responsibility drift that questionnaires aimed at the vendor never catch and configuration reviews do. The contract determines your information rights during the worst week: organizations with hour-denominated notification clauses and named channels scoped their exposure in days; those with 'without undue delay' and a legal-notices address read about their own breach in journalists' queries; the clause negotiation you deprioritized is the incident-response capability you will not have. Attestations describe the past and the perimeter of the report: SolarWinds held certifications; the compromise lived in the build pipeline, inside scope on paper, beyond sampling in practice; the correction is not attestation nihilism but weighting, treat reports as evidence about the vendor's control culture, add configuration and integration review for the access you actually grant, and reserve depth for the vendors whose failure is unabsorbable. And exits are where data goes to be forgotten: multiple public cases of former vendors' backups and successors' acquisitions resurfacing personal data trace to offboarding without deletion evidence; the register's closed entries need the certification attached, or they are not closed, only unpaid. The through-line: assessments fail less from asking wrong questions than from stopping, at signature, at the third party's boundary, at the attestation's scope, and the programs that hold up are the ones engineered to keep looking.