# AI Vendor Privacy Due Diligence Template

## Organisation: Cerebrum AI Labs

| Field | Value |
|-------|-------|
| Vendor Name | |
| Service Model | SaaS Inference / SaaS Training / API / Embedded / Platform |
| Assessment Date | |

## CONTROLLER-PROCESSOR DETERMINATION

| Question | Response |
|----------|----------|
| Does vendor determine processing purpose? | Yes / No |
| Does vendor train on customer data? | Yes / No |
| Is training opt-out available? | Yes / No |
| Does vendor retain data beyond service? | Yes / No |
| Does vendor make independent data decisions? | Yes / No |
| **Determined Role** | Processor / Joint Controller / Independent Controller |
| **Required Agreement** | Art. 28 DPA / Art. 26 JCA / Controller notice |

## RISK ASSESSMENT

| Factor | Assessment | Risk |
|--------|-----------|------|
| Data sensitivity | General / Special category | |
| Processing jurisdiction | EU / Non-EU: ___ | |
| Certifications | ISO 27001 / SOC 2 / None | |
| Sub-processors | Count: ___ | |
| Prior incidents | Count: ___ | |
| DPA in place | Yes / No | |
| Audit rights | Yes / No | |
| **Overall Risk** | Low / Medium / High / Critical |

## ACTIONS

| # | Action | Owner | Deadline |
|---|--------|-------|----------|
| 1 | | | |

| Role | Name | Date |
|------|------|------|
| Assessor | | |
| DPO | | |