Processing scope and purpose
Confirm the categories of data, the purposes and the duration are specific rather than open-ended.
Retention and deletion
Vague retention language is one of the most common sources of findings. Look for defined periods and a deletion commitment at termination.
Sub-processors and transfers
Record the notification mechanism, objection rights and the transfer mechanism relied upon.
Frequently asked questions
What does GDPR require when using a vendor?
Controllers must use only processors that provide sufficient guarantees of appropriate technical and organizational measures, and must have a written data processing agreement in place covering the processing.
What must a data processing agreement include?
Subject matter and duration, nature and purpose of processing, data categories, controller instructions, confidentiality, security measures, subprocessor rules, assistance with data subject rights, breach notification, deletion or return of data, and audit rights.
How should international data transfers be handled?
Identify where data is stored and accessed, then confirm a valid transfer mechanism such as an adequacy decision or standard contractual clauses, supported by a transfer impact assessment where required.
Do you need to approve vendor subprocessors?
The agreement should require prior notice of new subprocessors and give you a right to object. Keeping a current subprocessor list is an essential part of ongoing due diligence.
When is a data protection impact assessment needed?
A DPIA is required when processing is likely to result in high risk to individuals, for example large-scale processing of sensitive data, systematic monitoring, or automated decisions with significant effects.
ProcureCortex turns vendor documentation into structured, explainable compliance findings. Explore demo or explore the platform.
