Vendor Privacy Audit
Overview
GDPR Article 28(3)(h) requires that the processor "make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller." This audit right is a cornerstone of the controller's accountability obligations and must be exercisable in practice.
The EDPB Guidelines 07/2020 (paragraph 110) emphasize that audit rights must be practical and exercisable, not merely theoretical. Controllers must develop structured audit programs proportionate to the risk of the processing.
At Summit Cloud Partners, the Vendor Privacy Audit Program provides a systematic approach to verifying processor compliance through on-site inspections, remote audits, and documentation reviews.
Audit Types
Type 1: Documentation-Based Audit (Remote)
Suitable for standard-risk vendors with current third-party certifications.
| Aspect |
Detail |
| Scope |
Review of processor-provided documentation and certifications |
| Duration |
3-5 business days |
| Frequency |
Annual |
| Deliverable |
Documentation Audit Report |
| Cost allocation |
Controller bears own costs |
Evidence Reviewed:
- Current ISO 27001/27701 certificates and audit reports
- SOC 2 Type II report (including management assertions and exceptions)
- DPA compliance self-assessment questionnaire
- Sub-processor register and DPA coverage confirmation
- Incident log summary for audit period
- Training records and confidentiality agreement coverage
- Data subject request handling metrics
Type 2: Remote Technical Audit
Suitable for standard-to-high-risk vendors where on-site access is not practical.
| Aspect |
Detail |
| Scope |
Remote assessment including technical verification |
| Duration |
5-10 business days |
| Frequency |
Annual for high-risk; biennial for standard-risk |
| Deliverable |
Remote Audit Report |
| Cost allocation |
Per DPA terms (typically split) |
Activities:
- All documentation review activities from Type 1
- Video-conference interviews with vendor privacy and security teams
- Screen-sharing walkthrough of access control configurations
- Review of logging and monitoring dashboards
- Live demonstration of data subject request handling process
- Review of encryption key management procedures
- Penetration test report review (vendor-provided under NDA)
Type 3: On-Site Inspection
Required for high-risk vendors and when triggered by compliance concerns.
| Aspect |
Detail |
| Scope |
Physical inspection of processing facilities and controls |
| Duration |
1-3 days on-site, plus pre/post work |
| Frequency |
As needed; minimum biennial for highest-risk vendors |
| Deliverable |
On-Site Inspection Report |
| Cost allocation |
Per DPA terms |
Activities:
- All remote audit activities
- Physical security inspection of data processing facilities
- Server room and network infrastructure walkthrough
- Badge access system review and testing
- Clean desk policy verification
- Environmental controls inspection (fire suppression, climate, power)
- Personnel interviews (privacy officer, security team, operations staff)
- Observation of operational procedures (incident response, change management)
Audit Planning
Pre-Audit Activities
60 Days Before Audit:
| Activity |
Responsible |
| Select vendors for audit based on risk tier and schedule |
Privacy Team |
| Determine audit type (Documentation / Remote / On-Site) |
Privacy Team Lead |
| Assign audit team lead and members |
Privacy Team Lead |
| Notify vendor of audit intent per DPA notification requirements |
Audit Team Lead |
30 Days Before Audit:
| Activity |
Responsible |
| Issue formal audit notification letter to vendor |
Audit Team Lead |
| Submit document request list to vendor |
Audit Team |
| Schedule interview slots (for Type 2 and 3) |
Audit Team |
| Book travel and facilities (for Type 3) |
Operations |
| Prepare audit checklist customized for vendor's processing |
Audit Team |
7 Days Before Audit:
| Activity |
Responsible |
| Review vendor-provided documentation |
Audit Team |
| Prepare interview question sets |
Audit Team |
| Finalize on-site agenda (Type 3) |
Audit Team Lead |
| Conduct team briefing |
Audit Team Lead |
Audit Checklist
A. DPA Compliance Verification
| # |
Check Item |
Article |
Evidence Required |
| A1 |
Processing limited to documented controller instructions |
28(3)(a) |
Processing logs, instruction register |
| A2 |
All authorized personnel bound by confidentiality |
28(3)(b) |
Signed confidentiality agreements, HR records |
| A3 |
Article 32 security measures implemented per DPA Annex II |
28(3)(c) |
Security configuration evidence |
| A4 |
Sub-processors authorized and DPAs in place |
28(3)(d) |
Sub-processor register, executed DPAs |
| A5 |
DSR assistance capability demonstrated |
28(3)(e) |
DSR handling procedures, response metrics |
| A6 |
Compliance assistance provided for Art. 32-36 |
28(3)(f) |
DPIA contributions, breach investigation support |
| A7 |
Deletion/return capabilities verified |
28(3)(g) |
Deletion procedures, test results |
| A8 |
Audit information and access provided |
28(3)(h) |
Audit cooperation evidence |
B. Technical Controls Verification
| # |
Check Item |
Evidence Required |
| B1 |
Encryption at rest implemented per DPA specifications |
Key management documentation, configuration screenshots |
| B2 |
Encryption in transit per DPA specifications |
TLS configuration, certificate management |
| B3 |
Access controls configured per principle of least privilege |
RBAC configuration, access review records |
| B4 |
MFA enabled for all administrative access |
MFA enrollment records, policy configuration |
| B5 |
Logging enabled and retained per DPA retention period |
Log storage configuration, sample logs |
| B6 |
Vulnerability scanning performed per schedule |
Scan reports, remediation records |
| B7 |
Penetration testing performed per schedule |
Pen test reports, finding remediation |
| B8 |
Backup and recovery procedures tested |
DR test results, RPO/RTO metrics |
C. Organizational Controls Verification
| # |
Check Item |
Evidence Required |
| C1 |
Privacy training delivered to all relevant staff |
Training records with completion dates |
| C2 |
Incident response plan documented and tested |
IRP document, tabletop exercise records |
| C3 |
Change management process followed |
Change log, approval records |
| C4 |
Physical security controls in place (Type 3 only) |
Badge access logs, CCTV coverage, visitor log |
| C5 |
Data retention and deletion procedures operational |
Retention schedule, deletion logs |
| C6 |
Records of processing maintained per Art. 30(2) |
ROPA documentation |
D. Breach Notification Readiness
| # |
Check Item |
Evidence Required |
| D1 |
Breach detection capabilities operational |
SIEM configuration, alert rules |
| D2 |
Breach notification procedure documented with DPA-compliant timeframe |
IRP with notification section, contact matrix |
| D3 |
Breach notification contact details current |
Verified contact information |
| D4 |
Breach register maintained |
Breach log (redacted if necessary) |
Finding Classification
| Severity |
Definition |
Remediation Timeline |
Follow-Up |
| Critical |
Immediate risk to personal data or fundamental DPA violation |
Immediate (within 7 days) |
Verification audit within 30 days |
| Major |
Significant gap in controls or DPA non-compliance |
30 calendar days |
Written evidence of remediation |
| Minor |
Control weakness not immediately impacting data protection |
90 calendar days |
Verified at next scheduled audit |
| Observation |
Area for improvement, not a compliance gap |
Noted for next assessment |
Tracked in audit records |
Examples by Severity:
| Severity |
Example |
| Critical |
Personal data accessible to unauthorized personnel; no encryption at rest despite DPA requirement |
| Major |
Sub-processor engaged without notification; MFA not enforced for administrative access |
| Minor |
Privacy training completion at 85% (target 100%); access review 2 weeks overdue |
| Observation |
Incident response plan would benefit from more specific processor notification procedures |
Remediation Tracking
All findings above Observation severity enter the remediation tracking system:
| Field |
Description |
| Finding ID |
Unique identifier |
| Vendor |
Processor name |
| Audit date |
When finding was identified |
| Severity |
Critical / Major / Minor |
| Description |
Detailed description of the finding |
| Root cause |
Why the gap exists |
| Remediation plan |
Vendor's proposed corrective action |
| Deadline |
Date by which remediation must be complete |
| Evidence required |
What the vendor must provide to close the finding |
| Status |
Open / In Progress / Remediated / Verified / Overdue |
| Verification method |
How Summit Cloud Partners will verify remediation |
Key Regulatory References
- GDPR Article 28(3)(h) — Audit rights and compliance information
- GDPR Article 5(2) — Accountability principle
- GDPR Article 24 — Responsibility of the controller
- GDPR Article 32 — Security of processing
- EDPB Guidelines 07/2020 — Controller and processor concepts (paragraph 110 on practical audit rights)
- Bavarian DPA (BayLDA) — Processor Audit Guidelines (2022)
- ISO 19011:2018 — Guidelines for auditing management systems
1---2name: vendor-privacy-audit3description: On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.4license: Apache-2.05---67# Vendor Privacy Audit89## Overview1011GDPR Article 28(3)(h) requires that the processor "make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller." This audit right is a cornerstone of the controller's accountability obligations and must be exercisable in practice.1213The EDPB Guidelines 07/2020 (paragraph 110) emphasize that audit rights must be practical and exercisable, not merely theoretical. Controllers must develop structured audit programs proportionate to the risk of the processing.1415At Summit Cloud Partners, the Vendor Privacy Audit Program provides a systematic approach to verifying processor compliance through on-site inspections, remote audits, and documentation reviews.1617## Audit Types1819### Type 1: Documentation-Based Audit (Remote)2021Suitable for standard-risk vendors with current third-party certifications.2223| Aspect | Detail |24|--------|--------|25| **Scope** | Review of processor-provided documentation and certifications |26| **Duration** | 3-5 business days |27| **Frequency** | Annual |28| **Deliverable** | Documentation Audit Report |29| **Cost allocation** | Controller bears own costs |3031**Evidence Reviewed:**32- Current ISO 27001/27701 certificates and audit reports33- SOC 2 Type II report (including management assertions and exceptions)34- DPA compliance self-assessment questionnaire35- Sub-processor register and DPA coverage confirmation36- Incident log summary for audit period37- Training records and confidentiality agreement coverage38- Data subject request handling metrics3940### Type 2: Remote Technical Audit4142Suitable for standard-to-high-risk vendors where on-site access is not practical.4344| Aspect | Detail |45|--------|--------|46| **Scope** | Remote assessment including technical verification |47| **Duration** | 5-10 business days |48| **Frequency** | Annual for high-risk; biennial for standard-risk |49| **Deliverable** | Remote Audit Report |50| **Cost allocation** | Per DPA terms (typically split) |5152**Activities:**53- All documentation review activities from Type 154- Video-conference interviews with vendor privacy and security teams55- Screen-sharing walkthrough of access control configurations56- Review of logging and monitoring dashboards57- Live demonstration of data subject request handling process58- Review of encryption key management procedures59- Penetration test report review (vendor-provided under NDA)6061### Type 3: On-Site Inspection6263Required for high-risk vendors and when triggered by compliance concerns.6465| Aspect | Detail |66|--------|--------|67| **Scope** | Physical inspection of processing facilities and controls |68| **Duration** | 1-3 days on-site, plus pre/post work |69| **Frequency** | As needed; minimum biennial for highest-risk vendors |70| **Deliverable** | On-Site Inspection Report |71| **Cost allocation** | Per DPA terms |7273**Activities:**74- All remote audit activities75- Physical security inspection of data processing facilities76- Server room and network infrastructure walkthrough77- Badge access system review and testing78- Clean desk policy verification79- Environmental controls inspection (fire suppression, climate, power)80- Personnel interviews (privacy officer, security team, operations staff)81- Observation of operational procedures (incident response, change management)8283## Audit Planning8485### Pre-Audit Activities8687**60 Days Before Audit:**8889| Activity | Responsible |90|----------|-------------|91| Select vendors for audit based on risk tier and schedule | Privacy Team |92| Determine audit type (Documentation / Remote / On-Site) | Privacy Team Lead |93| Assign audit team lead and members | Privacy Team Lead |94| Notify vendor of audit intent per DPA notification requirements | Audit Team Lead |9596**30 Days Before Audit:**9798| Activity | Responsible |99|----------|-------------|100| Issue formal audit notification letter to vendor | Audit Team Lead |101| Submit document request list to vendor | Audit Team |102| Schedule interview slots (for Type 2 and 3) | Audit Team |103| Book travel and facilities (for Type 3) | Operations |104| Prepare audit checklist customized for vendor's processing | Audit Team |105106**7 Days Before Audit:**107108| Activity | Responsible |109|----------|-------------|110| Review vendor-provided documentation | Audit Team |111| Prepare interview question sets | Audit Team |112| Finalize on-site agenda (Type 3) | Audit Team Lead |113| Conduct team briefing | Audit Team Lead |114115### Audit Checklist116117**A. DPA Compliance Verification**118119| # | Check Item | Article | Evidence Required |120|---|-----------|---------|-------------------|121| A1 | Processing limited to documented controller instructions | 28(3)(a) | Processing logs, instruction register |122| A2 | All authorized personnel bound by confidentiality | 28(3)(b) | Signed confidentiality agreements, HR records |123| A3 | Article 32 security measures implemented per DPA Annex II | 28(3)(c) | Security configuration evidence |124| A4 | Sub-processors authorized and DPAs in place | 28(3)(d) | Sub-processor register, executed DPAs |125| A5 | DSR assistance capability demonstrated | 28(3)(e) | DSR handling procedures, response metrics |126| A6 | Compliance assistance provided for Art. 32-36 | 28(3)(f) | DPIA contributions, breach investigation support |127| A7 | Deletion/return capabilities verified | 28(3)(g) | Deletion procedures, test results |128| A8 | Audit information and access provided | 28(3)(h) | Audit cooperation evidence |129130**B. Technical Controls Verification**131132| # | Check Item | Evidence Required |133|---|-----------|-------------------|134| B1 | Encryption at rest implemented per DPA specifications | Key management documentation, configuration screenshots |135| B2 | Encryption in transit per DPA specifications | TLS configuration, certificate management |136| B3 | Access controls configured per principle of least privilege | RBAC configuration, access review records |137| B4 | MFA enabled for all administrative access | MFA enrollment records, policy configuration |138| B5 | Logging enabled and retained per DPA retention period | Log storage configuration, sample logs |139| B6 | Vulnerability scanning performed per schedule | Scan reports, remediation records |140| B7 | Penetration testing performed per schedule | Pen test reports, finding remediation |141| B8 | Backup and recovery procedures tested | DR test results, RPO/RTO metrics |142143**C. Organizational Controls Verification**144145| # | Check Item | Evidence Required |146|---|-----------|-------------------|147| C1 | Privacy training delivered to all relevant staff | Training records with completion dates |148| C2 | Incident response plan documented and tested | IRP document, tabletop exercise records |149| C3 | Change management process followed | Change log, approval records |150| C4 | Physical security controls in place (Type 3 only) | Badge access logs, CCTV coverage, visitor log |151| C5 | Data retention and deletion procedures operational | Retention schedule, deletion logs |152| C6 | Records of processing maintained per Art. 30(2) | ROPA documentation |153154**D. Breach Notification Readiness**155156| # | Check Item | Evidence Required |157|---|-----------|-------------------|158| D1 | Breach detection capabilities operational | SIEM configuration, alert rules |159| D2 | Breach notification procedure documented with DPA-compliant timeframe | IRP with notification section, contact matrix |160| D3 | Breach notification contact details current | Verified contact information |161| D4 | Breach register maintained | Breach log (redacted if necessary) |162163## Finding Classification164165| Severity | Definition | Remediation Timeline | Follow-Up |166|----------|-----------|---------------------|-----------|167| **Critical** | Immediate risk to personal data or fundamental DPA violation | Immediate (within 7 days) | Verification audit within 30 days |168| **Major** | Significant gap in controls or DPA non-compliance | 30 calendar days | Written evidence of remediation |169| **Minor** | Control weakness not immediately impacting data protection | 90 calendar days | Verified at next scheduled audit |170| **Observation** | Area for improvement, not a compliance gap | Noted for next assessment | Tracked in audit records |171172**Examples by Severity:**173174| Severity | Example |175|----------|---------|176| Critical | Personal data accessible to unauthorized personnel; no encryption at rest despite DPA requirement |177| Major | Sub-processor engaged without notification; MFA not enforced for administrative access |178| Minor | Privacy training completion at 85% (target 100%); access review 2 weeks overdue |179| Observation | Incident response plan would benefit from more specific processor notification procedures |180181## Remediation Tracking182183All findings above Observation severity enter the remediation tracking system:184185| Field | Description |186|-------|-------------|187| Finding ID | Unique identifier |188| Vendor | Processor name |189| Audit date | When finding was identified |190| Severity | Critical / Major / Minor |191| Description | Detailed description of the finding |192| Root cause | Why the gap exists |193| Remediation plan | Vendor's proposed corrective action |194| Deadline | Date by which remediation must be complete |195| Evidence required | What the vendor must provide to close the finding |196| Status | Open / In Progress / Remediated / Verified / Overdue |197| Verification method | How Summit Cloud Partners will verify remediation |198199## Key Regulatory References200201- GDPR Article 28(3)(h) — Audit rights and compliance information202- GDPR Article 5(2) — Accountability principle203- GDPR Article 24 — Responsibility of the controller204- GDPR Article 32 — Security of processing205- EDPB Guidelines 07/2020 — Controller and processor concepts (paragraph 110 on practical audit rights)206- Bavarian DPA (BayLDA) — Processor Audit Guidelines (2022)207- ISO 19011:2018 — Guidelines for auditing management systems
ThomasMoreAI