Peer practices: data protection questionnaire for suppliers

One of our members has anonymously shared the ‘Data Protection Questionnaire’ they have implemented as a preliminary requirement in their Request for Proposals (RFPs). This questionnaire is added as an addendum to any RFP involving personal data and requires suppliers to disclose their data protection practices. It applies to services handling employee, supplier or third-party data, setting a high privacy standard from the outset.

Through this questionnaire, the company can investigate whether candidate suppliers align with its privacy rules, which closely follow GDPR standards. The questions cover:

• Whether the supplier identifies as a processor or controller
• The location of processing activities
• Encryption practices
• Access logging

This questionnaire serves a preliminary, exploratory purpose. Once a supplier is chosen, a formal Data Protection Agreement (DPA) is drawn up.

Our thanks to this member for sharing! The document is available for Beltug members after log-in