Data Processor Due Diligence Questionnaire Template: GDPR Article 28 Checks Before Sharing Data

GDPR Article 28(1) says a controller may only use processors that provide sufficient guarantees, yet many organisations sign a data processing agreement without ever checking that the processor can do what the agreement promises. This template is a due diligence questionnaire you send to a prospective or existing processor before personal data is shared. Its questions follow Article 28 point by point: instructions, confidentiality, Article 32 security measures, sub-processors, international transfers, assistance with data subject rights, breach notification, deletion and return, and audit. It is deliberately privacy focused: general vendor security questions belong in your third-party security questionnaire, and this template points to that rather than repeating it. It is for privacy, data protection officer, procurement and third-party risk teams. For the wider GDPR programme, see the GDPR Compliance Guide for Security Teams.

How to use this template

• Send the questionnaire before contract signature and before any personal data is transferred, and repeat it at renewal or on a material change in processing.
• Replace text in square brackets, such as [Organisation], [Processor] and [Service], with your own terms. Delete the guidance notes in italics before sending.
• Ask for evidence, not just yes or no: each section lists the documents to request. Record the reviewer's assessment and any follow-up action next to each answer.
• Scale the depth to risk. A processor handling special category data, large volumes or children's data gets every question; a low-risk tool may only need sections 1 to 5 and 9.
• Article 28(5) allows adherence to an approved code of conduct (Article 40) or certification (Article 42) to be used as an element of sufficient guarantees. Record any that apply in section 2, but still review the other answers.
• This questionnaire supports the assessment; it does not replace the Article 28(3) contract. Section 11 maps answers to contract clauses.

Article 28 to questionnaire map

1. Processor and processing details

1. Legal entity name, registered address and company number of [Processor]. Is the contracting entity the same as the entity that will process the data?
2. If [Processor] is established outside the EU or UK, who is its representative under Article 27, where required?
3. Name and contact details of the data protection officer or privacy lead.
4. Describe the processing: subject matter, duration, nature and purpose, types of personal data, categories of data subjects. Will any special category data (Article 9) or criminal offence data (Article 10) be processed?
5. In which countries and data centres will the data be stored, accessed or supported from?
6. Does [Processor] maintain a record of processing activities as a processor under Article 30(2)?

Evidence: data flow diagram, list of hosting locations, Article 30(2) record extract.

2. Expertise, reliability and resources

GDPR Recital 81 frames sufficient guarantees in terms of the processor's expert knowledge, reliability and resources.

1. How long has [Processor] provided this service, and to how many customers in a comparable sector?
2. Has [Processor] been subject to a supervisory authority investigation, order or fine relating to data protection in the last [three] years? Give details.
3. Which certifications or attestations cover the in-scope service: ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II, an approved GDPR code of conduct or certification? Give scope and expiry dates.
4. How many staff are dedicated to privacy and security, and who has board-level accountability?

Evidence: certificates with scope statements, latest SOC 2 report under NDA, privacy policy, any regulator correspondence.

3. Instructions, confidentiality and lawful use

1. How does [Processor] ensure personal data is processed only on [Organisation]'s documented instructions? Is any data used for [Processor]'s own purposes, such as product improvement, analytics or training AI models? If so, describe it and how it can be switched off.
2. What is the process for informing [Organisation] if [Processor] believes an instruction infringes data protection law (Article 28(3) closing paragraph)?
3. What is the process if [Processor] receives a legal requirement to process data otherwise, including a government or law enforcement access request? Will [Organisation] be told unless the law prohibits it?
4. Are all staff and contractors with access bound by confidentiality obligations? How is this evidenced?

4. Security of processing (Article 32)

Keep this section short and privacy specific. Use your general third-party security questionnaire for the full control set, for example the SaaS Integration Security Questionnaire Template.

1. Is personal data encrypted in transit and at rest? Who manages the keys, and can [Organisation] hold its own keys?
2. Is pseudonymisation or data minimisation applied in the service, for example in logs, test environments and support tooling?
3. How is access to [Organisation]'s personal data restricted, approved, logged and reviewed? Which staff roles and which non-human identities, such as service accounts and API keys, can read it?
4. How does [Processor] ensure ongoing confidentiality, integrity, availability and resilience, and restore access to personal data after an incident? Give tested recovery objectives.
5. How often are measures tested, for example penetration tests and control audits, and can [Organisation] see summary results?
6. How are customer environments separated in a multi-tenant service?

5. Sub-processors

1. Provide the full list of sub-processors for the service, with entity name, function, data categories accessed and processing location.
2. Is authorisation sought specifically for each sub-processor, or under a general written authorisation? How much advance notice is given of additions or replacements, by what channel, and how can [Organisation] object (Article 28(2))?
3. What happens if [Organisation] objects: alternative arrangement, termination right, refund?
4. How does [Processor] impose the same data protection obligations on sub-processors (Article 28(4)), and how does it assess and audit them?
5. Does [Processor] accept that it remains fully liable to [Organisation] for sub-processors' performance (Article 28(4))?

Evidence: sub-processor list URL, notification mechanism, a sample sub-processor flow-down clause.

6. International transfers

1. Will personal data be transferred to, or accessed from, any country outside the EEA or UK, including for support and follow-the-sun operations?
2. For each transfer, which mechanism under GDPR Chapter V applies: adequacy decision, standard contractual clauses (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Agreement or Addendum, binding corporate rules, or a derogation?
3. Has [Processor] carried out a transfer impact assessment, and will it share it? What supplementary measures apply? See the Transfer Impact Assessment (TIA) Template.
4. How many government access requests for customer data did [Processor] receive in the last year, and is a transparency report published?

7. Data subject rights assistance

1. How can [Organisation] locate, export, correct, restrict and delete an individual's data in the service, for example through a console, API or ticket?
2. If [Processor] receives a request directly from a data subject, how quickly will it forward it to [Organisation]?
3. What is the committed turnaround for assistance, given the one month response period under Article 12(3)?

8. Breach notification and compliance assistance

1. What is the committed time to notify [Organisation] after becoming aware of a personal data breach? Article 33(2) requires notification without undue delay; most controllers set a contractual limit, for example [24 to 48] hours, to protect their own 72-hour window under Article 33(1).
2. What will the notice contain: nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken, contact point?
3. Describe the last personal data breach affecting customers, how it was handled and what changed. Have there been none?
4. Will [Processor] support a data protection impact assessment (Article 35) and any prior consultation (Article 36) with the information it holds? See the DPIA Template.

9. Deletion and return at end of service

1. At the end of the service, how can [Organisation] choose between return and deletion of all personal data (Article 28(3)(g))? In what formats is data returned?
2. How long after termination is data deleted from production systems, and from backups and logs?
3. Will [Processor] confirm deletion in writing? Which copies, if any, must it retain under EU or member state law, and on what legal basis?
4. What retention settings can [Organisation] configure during the service?

See the Data Retention and Secure Deletion Guide.

10. Audit and demonstration of compliance

1. Which information will [Processor] provide to demonstrate compliance with Article 28 (Article 28(3)(h))?
2. Will [Processor] allow and contribute to audits and inspections by [Organisation] or an auditor it mandates? Under what notice, frequency and cost conditions?
3. Will third-party audit reports be accepted in place of an on-site audit, and will [Organisation] retain the right to audit after a serious incident?

11. Reviewer assessment and contract mapping

Overall decision: [approve / approve with conditions / reject], by [DPO or privacy lead], on [date]. Next review: [date].

Implementation guidance

• Tier first: decide depth from the processing risk, not the contract value. A free tool that ingests customer records can carry more privacy risk than a large infrastructure contract. See the Vendor Tiering and Inherent Risk Questionnaire Template.
• Use the standard clauses where they fit: Article 28(7) allows the Commission to lay down standard contractual clauses for controller to processor contracts, and it did so in Commission Implementing Decision (EU) 2021/915. Comparing the processor's DPA with those clauses is a quick way to find gaps.
• Watch for own-purpose processing: a processor that uses customer personal data for its own purposes, such as training AI models, may be acting as a controller for that processing. Escalate such answers to legal review.
• Measure it: track the share of processors with a completed questionnaire before data sharing, the share reviewed in the last 12 months, the number of conditional approvals with open actions, the median contractual breach notice time, and the share of processors whose sub-processor lists you monitor.
• Common failure patterns: accepting a certification without reading its scope; not monitoring sub-processor change notices so the objection window passes; no contractual breach notice limit; deletion that excludes backups; and transfers to support teams outside the EEA that nobody asked about.
• Framework mapping: NIST CSF 2.0 GV.SC-06 (due diligence before entering supplier relationships) and GV.SC-07 (supplier risk monitored over the relationship); NIST SP 800-53 Rev 5 SA-9 External System Services and SR-6 Supplier Assessments and Reviews.
• UK note: the ICO states its controller and processor guidance is under review following the Data (Use and Access) Act 2025; check the current ICO position for UK GDPR processing.

Standards and references

• GDPR text: Article 28 Processor
• EDPB: Guidelines 07/2020 on the concepts of controller and processor in the GDPR
• ICO: Contracts and liabilities between controllers and processors

Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · International Data Transfers Map · Third-Party Risk Management Guide · Security Questionnaires Guide. This template summarises GDPR processor requirements and is not legal advice.