# Vendor Privacy Audit Report

## Audit Information

| Field | Value |
|-------|-------|
| **Audit ID** | [AUDIT-YYYY-NNN] |
| **Vendor Name** | [Vendor Legal Name] |
| **Audit Type** | [Documentation Review / Remote Technical / On-Site Inspection] |
| **Audit Trigger** | [Annual Schedule / Vendor Breach / Complaint / Other] |
| **Audit Team Lead** | [Name, Title] |
| **Audit Team Members** | [Names and Titles] |
| **Notification Date** | [YYYY-MM-DD] |
| **Execution Date(s)** | [YYYY-MM-DD] |
| **Report Date** | [YYYY-MM-DD] |
| **Previous Audit** | [AUDIT-YYYY-NNN or "First Audit"] |

## Executive Summary

**Overall Assessment:** [Compliant / Substantially Compliant / Partially Compliant / Non-Compliant]

**Compliance Rate:** [X]% of checklist items assessed as compliant

**Finding Summary:**

| Severity | Count |
|----------|-------|
| Critical | [N] |
| Major | [N] |
| Minor | [N] |
| Observation | [N] |
| **Total** | **[N]** |

**Key Strengths:**
- [Strength 1]
- [Strength 2]

**Key Concerns:**
- [Concern 1]
- [Concern 2]

## Scope and Methodology

**Scope:** This audit assessed [Vendor Name]'s compliance with the Data Processing Agreement dated [Date] and GDPR Article 28 obligations in connection with [description of processing].

**Methodology:**
- [Documentation review / Remote interviews / On-site inspection]
- [Checklist-based assessment covering DPA compliance, technical controls, organizational controls, and breach notification readiness]
- [Certification verification / Technical testing / etc.]

**Limitations:**
- [Any scope limitations or access restrictions]

## Detailed Findings

### Section A — DPA Compliance

| ID | Check Item | Article | Result | Notes |
|----|-----------|---------|--------|-------|
| A1 | Processing on documented instructions | 28(3)(a) | [Status] | [Notes] |
| A2 | Confidentiality of personnel | 28(3)(b) | [Status] | [Notes] |
| A3 | Art. 32 security measures | 28(3)(c) | [Status] | [Notes] |
| A4 | Sub-processor compliance | 28(3)(d) | [Status] | [Notes] |
| A5 | DSR assistance | 28(3)(e) | [Status] | [Notes] |
| A6 | Art. 32-36 compliance assistance | 28(3)(f) | [Status] | [Notes] |
| A7 | Deletion/return capabilities | 28(3)(g) | [Status] | [Notes] |
| A8 | Audit information and access | 28(3)(h) | [Status] | [Notes] |

### Section B — Technical Controls

| ID | Check Item | Result | Notes |
|----|-----------|--------|-------|
| B1 | Encryption at rest | [Status] | [Notes] |
| B2 | Encryption in transit | [Status] | [Notes] |
| B3 | Access controls | [Status] | [Notes] |
| B4 | MFA enforcement | [Status] | [Notes] |
| B5 | Logging and retention | [Status] | [Notes] |
| B6 | Vulnerability scanning | [Status] | [Notes] |
| B7 | Penetration testing | [Status] | [Notes] |
| B8 | Backup and recovery | [Status] | [Notes] |

### Section C — Organizational Controls

| ID | Check Item | Result | Notes |
|----|-----------|--------|-------|
| C1 | Privacy training | [Status] | [Notes] |
| C2 | Incident response plan | [Status] | [Notes] |
| C3 | Change management | [Status] | [Notes] |
| C4 | Data retention/deletion | [Status] | [Notes] |
| C5 | Records of processing | [Status] | [Notes] |

### Section D — Breach Notification Readiness

| ID | Check Item | Result | Notes |
|----|-----------|--------|-------|
| D1 | Breach detection capabilities | [Status] | [Notes] |
| D2 | Notification procedure | [Status] | [Notes] |
| D3 | Contact details current | [Status] | [Notes] |
| D4 | Breach register maintained | [Status] | [Notes] |

## Findings Register

### Finding [F-001]

| Field | Value |
|-------|-------|
| **Severity** | [Critical / Major / Minor / Observation] |
| **Checklist Item** | [ID — Description] |
| **Description** | [Detailed description of the finding] |
| **Root Cause** | [Why this gap exists] |
| **Recommendation** | [Proposed corrective action] |
| **Remediation Deadline** | [YYYY-MM-DD] |
| **Evidence Required** | [What vendor must provide to close] |

### Finding [F-002]

[Repeat structure for each finding]

## Comparison with Previous Audit

| Metric | Previous Audit | Current Audit | Trend |
|--------|---------------|---------------|-------|
| Compliance rate | [X]% | [X]% | [Improved/Declined/Stable] |
| Critical findings | [N] | [N] | [Improved/Declined/Stable] |
| Major findings | [N] | [N] | [Improved/Declined/Stable] |
| Open findings carried forward | [N] | [N] | |
| Previously identified findings now closed | [N] | | |

## Remediation Action Plan

| Finding ID | Severity | Vendor Proposed Action | Deadline | Status |
|-----------|----------|----------------------|----------|--------|
| [F-001] | [Severity] | [Action] | [Date] | [Open] |
| [F-002] | [Severity] | [Action] | [Date] | [Open] |

## Approvals

| Role | Name | Date |
|------|------|------|
| Audit Team Lead | [Name] | [Date] |
| Privacy Team Lead | [Name] | [Date] |
| DPO (for Critical/Major findings) | [Name] | [Date] |

---

*This audit was conducted pursuant to GDPR Article 28(3)(h) and the audit rights specified in the Data Processing Agreement between Summit Cloud Partners and [Vendor Name]. Audit records are retained per the Summit Cloud Partners document retention policy (minimum 3 years).*