All guides

Privacy and GDPR questions in a security questionnaire

Privacy questions ask about GDPR, a data processing agreement, transfers outside the EU, a Data Protection Officer and help with data subject requests. The accurate answers are shorter than most people expect.

What the client wants to know

If you process personal data on a client's behalf, the client is the controller and you are the processor, and they need a data processing agreement (DPA) with you. They ask whether you will sign theirs, where data goes, who handles data protection and how fast you help with access or deletion requests.

The 5 questions as clients phrase them

The kit covers 5 questions in this area. The wording varies between questionnaires, the control behind it does not.

1. Are you compliant with GDPR?
2. Will you sign our data processing agreement (DPA)?
3. Is data transferred outside the EU/EEA?
4. Have you appointed a Data Protection Officer (DPO)?
5. Can you help us answer data subject requests (access, deletion)?

What a good answer contains

• GDPR: say you process personal data in line with GDPR where it applies and sign a DPA when you process personal data on the client's behalf. There is no GDPR certification, so do not claim one.
• DPA: yes, where you process personal data on the client's behalf. Ask them to send theirs for review.
• Transfers: name the storage region. Where a provider transfers data outside the EU/EEA, say whether it relies on the EU-US Data Privacy Framework or Standard Contractual Clauses.
• DPO: GDPR requires a DPO only in specific cases, for example large-scale processing of sensitive data. If you have not appointed one, name who handles data protection questions.
• Data subject requests: forward a request that reaches you to the client without delay and help answer it within the deadlines in the DPA.

Watch out for

Check your providers' transfer mechanism before you quote it. The kit's answer is a starting point: the details per provider have to come from the providers.

Example: how a prepared answer opens

Question: Will you sign our data processing agreement (DPA)?

Yes, where we process personal data on your behalf.

This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.

Back to all guides

Related: Data protection Vendors and subprocessors

Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.