# Vendor Processing PIA — Workflows

## Workflow 1: Vendor Data Processing Inventory
1. Identify all vendors (processors) that process personal data on behalf of the organisation.
2. For each vendor, document: vendor name, service description, personal data categories, data subject categories, processing purposes, data volumes, data locations.
3. Identify sub-processors used by each vendor.
4. Classify vendors by risk level: high (special category data, large scale, cross-border), medium (standard personal data, moderate scale), low (limited access, no storage).
5. Record inventory in the vendor register.

## Workflow 2: Vendor Due Diligence
1. Request vendor security documentation: certifications (ISO 27001, SOC 2), security policies, incident response plan.
2. Request vendor privacy documentation: DPA template, privacy policy, DPIA evidence, DPO contact.
3. Send vendor privacy and security questionnaire covering: encryption, access controls, data retention, breach notification, sub-processor management, data subject rights assistance.
4. Check vendor enforcement history with supervisory authorities.
5. Assess vendor responses against organisational risk tolerance.
6. Document due diligence findings and approval/rejection decision.

## Workflow 3: Data Processing Agreement Review
1. Obtain the vendor's DPA (or provide the organisation's DPA template).
2. Verify all GDPR Article 28(3) mandatory provisions are included:
   a. Process only on documented instructions from the controller.
   b. Ensure persons authorised to process are bound by confidentiality.
   c. Take all required security measures per Article 32.
   d. Comply with sub-processor engagement conditions.
   e. Assist the controller with data subject rights requests.
   f. Assist with security, breach notification, DPIA, and prior consultation obligations.
   g. Delete or return all personal data at end of service.
   h. Make available all information necessary to demonstrate compliance and allow audits.
3. Check sub-processor authorisation clause: specific authorisation or general authorisation with notification and objection right.
4. Verify cross-border transfer mechanisms if vendor is outside EEA.
5. Review liability, indemnification, and limitation of liability clauses.
6. Negotiate and finalise DPA; obtain signatures.

## Workflow 4: Sub-Processor Management
1. Obtain the vendor's current sub-processor list.
2. Assess each sub-processor's role, data access, and geographic location.
3. Evaluate sub-processor risk (same criteria as primary vendor).
4. Verify that the vendor has flow-down DPA obligations to sub-processors (Art. 28(4)).
5. Subscribe to vendor sub-processor change notifications.
6. Establish objection process: assess new sub-processors within notification period and raise objections if risk is unacceptable.
7. Document sub-processor assessment results.

## Workflow 5: Ongoing Vendor Monitoring
1. Schedule periodic vendor reviews based on risk classification (high: annual, medium: biennial, low: triennial).
2. Send annual vendor reassessment questionnaire.
3. Review vendor audit reports (SOC 2, ISO 27001 surveillance audits).
4. Track vendor security incidents and breach notifications.
5. Monitor sub-processor changes.
6. Conduct or commission on-site or remote audits for high-risk vendors.
7. Update vendor risk classification based on review findings.
8. Document monitoring results and remediation actions.

## Workflow 6: Vendor Exit and Data Return
1. Notify vendor of contract termination or non-renewal.
2. Request data return in a structured, commonly used, machine-readable format.
3. Verify completeness of returned data against the processing register.
4. Request written confirmation of data deletion from vendor systems (including backups).
5. Verify deletion confirmation and retain as compliance evidence.
6. Update vendor register to reflect terminated status.
7. Transition services to replacement vendor or in-house with DPIA for new arrangement.