Vendor Risk Assessment Template: Free Tool

What we look up

A plain template you can copy or print. Pick a vendor above to fill in what we already have on file.

Vendor risk assessment

Subprocessors
    The companies named on the vendor's published list, and how many sit outside the EU/EEA.

DPA terms
    Breach notice: The time limit and what starts the clock.
    Subprocessor change notice: How much notice the DPA gives before a new subprocessor is added.
    Data transfers out of the EU: The mechanisms named for transfers out of the EU.
    Deletion or return at the end: Whether customer data is deleted or returned when the contract ends.
    Audit rights: Whether the DPA gives you a right to audit or to see audit reports.

Transfer mechanism
    Standard contractual clauses (SCCs): Whether the DPA names standard contractual clauses.
    EU–US Data Privacy Framework (DPF): Whether the DPA names the EU–US Data Privacy Framework.
    Binding corporate rules (BCRs): Whether the DPA names binding corporate rules.
    Adequacy decisions: Whether the DPA names an adequacy decision.

AI-usage terms
    What the documents say about training on customer data, model providers and opt-out.

Recent changes
    Approved changes to the DPA, subprocessor list or AI terms.

This shows what the vendor's published documents say, as of the dates shown. It isn't a compliance assessment of the vendor or legal advice, and it doesn't show what you have signed. Check the vendor's documents and your contract before relying on it.

Subprocessors

The companies named on the vendor's published list, and how many sit outside the EU/EEA.
DPA terms
- Breach notice: The time limit and what starts the clock.
- Subprocessor change notice: How much notice the DPA gives before a new subprocessor is added.
- Data transfers out of the EU: The mechanisms named for transfers out of the EU.
- Deletion or return at the end: Whether customer data is deleted or returned when the contract ends.
- Audit rights: Whether the DPA gives you a right to audit or to see audit reports.
Transfer mechanism (SCC or DPF)
- Standard contractual clauses (SCCs): Whether the DPA names standard contractual clauses.
- EU–US Data Privacy Framework (DPF): Whether the DPA names the EU–US Data Privacy Framework.
- Binding corporate rules (BCRs): Whether the DPA names binding corporate rules.
- Adequacy decisions: Whether the DPA names an adequacy decision.
AI-usage terms

What the documents say about training on customer data, model providers and opt-out.
Recent changes

Approved changes to the DPA, subprocessor list or AI terms.