GDPR vendor checklist

Eight key things to check before you use a vendor: DPA, subprocessors, transfers, breach notice, deletion, audit rights and certifications. Not a complete Article 28 review: your contract must also cover instructions, confidentiality, security (Art. 32) and help with data-subject requests. Pick a vendor from the ClauseTrail catalogue to see what we already have on file. Everything else you check yourself.

Vendor

What to check

A plain checklist you can copy or print. Pick a vendor above to pre-fill what we already have on file.

GDPR vendor checklist
Generated 4 Nov 2026

1. [check] Data processing agreement (Art. 28)
    Find the vendor's Article 28 DPA and make sure you have accepted or signed it.

2. [check] Subprocessor list published
    Look for a published list of the vendor's subprocessors.

3. [check] Subprocessor change notice period
    Check how much notice the DPA gives before a new subprocessor is added.

4. [check] Transfer mechanism (SCCs, DPF or other)
    The DPF covers EU→US transfers to certified US companies only and can be challenged; SCCs also need a transfer assessment.

5. [check] Breach notice time
    Check how quickly the vendor must tell you about a personal data breach.

6. [check] Deletion at end of contract
    Check that customer data is deleted or returned when the contract ends.

7. [check] Audit rights
    Check whether the DPA gives you a right to audit or to see audit reports.

8. [check] Security certifications
    Check for current SOC 2, ISO 27001 or similar reports.

This shows what the vendor's published documents say, as of the dates shown. It isn't a compliance assessment of the vendor or legal advice, and it doesn't show what you have signed. Check the vendor's documents and your contract before relying on it.

Data processing agreement (Art. 28)

Find the vendor's Article 28 DPA and make sure you have accepted or signed it.
Subprocessor list published

Look for a published list of the vendor's subprocessors.
Subprocessor change notice period

Check how much notice the DPA gives before a new subprocessor is added.
Transfer mechanism (SCCs, DPF or other)

The DPF covers EU→US transfers to certified US companies only and can be challenged; SCCs also need a transfer assessment.
Breach notice time

Check how quickly the vendor must tell you about a personal data breach.
Deletion at end of contract

Check that customer data is deleted or returned when the contract ends.
Audit rights

Check whether the DPA gives you a right to audit or to see audit reports.
Security certifications

Check for current SOC 2, ISO 27001 or similar reports.