# Vendor Processing PIA Template

## 1. Organisation Information

| Field | Value |
|-------|-------|
| Organisation name | |
| Assessment date | |
| DPO name | |
| Total vendors processing personal data | |

## 2. Vendor Inventory

| Vendor ID | Vendor Name | Service | Risk Category | Data Categories | Subject Count | Cross-Border |
|---|---|---|---|---|---|---|
| | | | Cloud / SaaS / Analytics / IT / Payment / Marketing / HR / Other | | | Yes / No |
| | | | | | | |

## 3. Due Diligence Checklist (per vendor)

**Vendor**: _______________

| Check | Completed | Evidence |
|-------|-----------|---------|
| Security certifications reviewed (ISO 27001, SOC 2) | Yes / No | |
| Privacy certifications reviewed (ISO 27701, APEC CBPR) | Yes / No | |
| Enforcement history checked | Yes / No | |
| Security questionnaire completed | Yes / No | |
| Breach notification capability verified | Yes / No | |
| Sub-processor list obtained | Yes / No | |
| Data subject rights assistance verified | Yes / No | |

## 4. DPA Review Checklist (Art. 28(3))

**Vendor**: _______________

| Mandatory Clause | Present | Adequate |
|-----------------|---------|---------|
| (a) Process only on documented instructions | Yes / No | Yes / No |
| (b) Confidentiality obligations | Yes / No | Yes / No |
| (c) Security measures per Art. 32 | Yes / No | Yes / No |
| (d) Sub-processor engagement conditions | Yes / No | Yes / No |
| (e) Assist with data subject rights | Yes / No | Yes / No |
| (f) Assist with security, breach, DPIA | Yes / No | Yes / No |
| (g) Delete or return data at termination | Yes / No | Yes / No |
| (h) Audit information and access | Yes / No | Yes / No |

## 5. Sub-Processor Assessment

**Vendor**: _______________

| Sub-Processor | Service | Location | Assessed | DPA Flow-Down |
|---|---|---|---|---|
| | | | Yes / No | Yes / No |
| | | | | |

- [ ] Sub-processor change notification process in place
- [ ] Objection mechanism documented

## 6. Cross-Border Transfer Assessment

| Vendor | Destination | Transfer Mechanism | TIA Conducted | Supplementary Measures |
|--------|------------|-------------------|---------------|----------------------|
| | | Adequacy / SCCs / BCRs / Derogation | Yes / No | |
| | | | | |

## 7. Vendor Risk Assessment

| Vendor | Category Risk | Data Sensitivity | Scale | Cross-Border | Sub-Processors | Overall Risk |
|--------|-------------|-----------------|-------|-------------|---------------|-------------|
| | | | | | | Low / Medium / High / Critical |
| | | | | | | |

## 8. Ongoing Monitoring Plan

| Vendor | Review Frequency | Next Review Date | Audit Required | Incident Tracking |
|--------|-----------------|-----------------|---------------|------------------|
| | Annual / Biennial / Triennial | | Yes / No | Yes / No |
| | | | | |

## 9. Vendor Exit Plan

| Vendor | Data Return Format | Deletion Confirmation | Transition Plan |
|--------|-------------------|----------------------|----------------|
| | | Yes / No | Yes / No |
| | | | |

## 10. Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| DPO | | | |
| Procurement Lead | | | |
| CISO | | | |
| Legal Counsel | | | |