# Vendor Privacy Due Diligence — Assessment Report Template

## Report Information

| Field | Value |
|-------|-------|
| **Controller Organization** | Summit Cloud Partners |
| **Vendor Name** | [Vendor Legal Name] |
| **Vendor Contact** | [Primary Privacy Contact] |
| **Assessment Type** | [Initial / Annual Reassessment / Trigger-Based] |
| **Trigger** | [If trigger-based: describe triggering event] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessor** | [Privacy Analyst Name] |
| **Approver** | [DPO / Privacy Lead Name] |
| **Risk Tier** | [High / Standard / Low] |

## 1. Vendor Overview

**Legal Name:** [Full legal name]
**Jurisdiction of Establishment:** [Country/countries]
**Data Protection Officer:** [Name and contact]
**Services Provided to Summit Cloud Partners:** [Description of services]

## 2. Processing Determination

| Question | Answer |
|----------|--------|
| Will the vendor access, store, or transmit personal data? | [Yes/No] |
| Will the vendor host systems containing personal data? | [Yes/No] |
| Will the vendor have logical or physical access to infrastructure holding personal data? | [Yes/No] |
| **Due diligence required?** | **[Yes/No]** |

## 3. Data Flow Analysis

### 3.1 Data Categories

| Category | Classification | Volume |
|----------|---------------|--------|
| [e.g., Email addresses] | [Confidential] | [Approximate count] |
| [e.g., Usage metrics] | [Internal] | [Approximate count] |

### 3.2 Data Subject Categories

| Category | Approximate Volume |
|----------|-------------------|
| [e.g., Enterprise customers] | [Count] |

### 3.3 Processing Locations

| Location | Function | Transfer Mechanism |
|----------|----------|-------------------|
| [Country, City] | [Primary processing] | [N/A — within EEA] |
| [Country, City] | [Backup/DR] | [SCC / Adequacy / etc.] |

### 3.4 Sub-Processors

| Sub-Processor | Location | Function | Assessment Status |
|--------------|----------|----------|------------------|
| [Name] | [Country] | [Service] | [Assessed / Pending] |

## 4. Questionnaire Assessment

### Section A — Legal Governance (Weight: 15%)

| Q# | Question | Score (1-5) | Notes |
|----|----------|-------------|-------|
| A1 | Designated DPO? | [Score] | [Notes] |
| A2 | Jurisdictions of establishment? | [Score] | [Notes] |
| A3 | GDPR governance structure? | [Score] | [Notes] |
| A4 | Enforcement history? | [Score] | [Notes] |
| A5 | Article 30 records? | [Score] | [Notes] |
| A6 | Lawful basis documentation? | [Score] | [Notes] |
| A7 | DPIA process? | [Score] | [Notes] |
| **Section Average** | | **[X.X]** | |

### Section B — Technical Security (Weight: 25%)

| Q# | Question | Score (1-5) | Notes |
|----|----------|-------------|-------|
| B1 | Encryption (at rest / in transit)? | [Score] | [Notes] |
| B2 | Access controls and authentication? | [Score] | [Notes] |
| B3 | Vulnerability management? | [Score] | [Notes] |
| B4 | Logging and monitoring? | [Score] | [Notes] |
| B5 | Incident detection and response? | [Score] | [Notes] |
| B6 | Secure development practices? | [Score] | [Notes] |
| B7 | Physical security? | [Score] | [Notes] |
| **Section Average** | | **[X.X]** | |

### Section C — Data Handling (Weight: 20%)

| Q# | Question | Score (1-5) | Notes |
|----|----------|-------------|-------|
| C1 | Client data segregation? | [Score] | [Notes] |
| C2 | Data retention and deletion? | [Score] | [Notes] |
| C3 | DSR handling process? | [Score] | [Notes] |
| C4 | Backup and recovery? | [Score] | [Notes] |
| C5 | Processing locations outside EEA? | [Score] | [Notes] |
| C6 | Sub-processor engagement process? | [Score] | [Notes] |
| **Section Average** | | **[X.X]** | |

### Section D — Certifications (Weight: 15%)

| Q# | Question | Score (1-5) | Notes |
|----|----------|-------------|-------|
| D1 | ISO 27001? | [Score] | [Notes] |
| D2 | ISO 27701? | [Score] | [Notes] |
| D3 | SOC 2 Type II? | [Score] | [Notes] |
| D4 | Cloud-specific (CSA STAR, 27017/27018)? | [Score] | [Notes] |
| D5 | GDPR Code of Conduct (Art. 40)? | [Score] | [Notes] |
| D6 | GDPR Certification (Art. 42)? | [Score] | [Notes] |
| **Section Average** | | **[X.X]** | |

### Supplementary Assessments

| Domain | Score (1-5) | Assessment Method | Notes |
|--------|-------------|-------------------|-------|
| Breach / enforcement history | [Score] | Public record search | [Notes] |
| Sub-processor management | [Score] | Documentation review | [Notes] |
| Cross-border transfer safeguards | [Score] | Transfer Impact Assessment | [Notes] |

## 5. Verification Activities

| Activity | Date | Findings |
|----------|------|----------|
| ISO 27001 certificate verification | [Date] | [Verified/Discrepancy] |
| SOC 2 report review | [Date] | [Findings summary] |
| Public record search (enforcement actions) | [Date] | [Findings] |
| Reference check | [Date] | [Summary] |
| Technical endpoint scan (if conducted) | [Date] | [Summary] |

## 6. Sufficiency Scoring

| Domain | Weight | Score | Weighted |
|--------|--------|-------|----------|
| Legal governance | 15% | [X.X] | [X.XX] |
| Technical security | 25% | [X.X] | [X.XX] |
| Data handling | 20% | [X.X] | [X.XX] |
| Certifications | 15% | [X.X] | [X.XX] |
| Breach/enforcement history | 10% | [X.X] | [X.XX] |
| Sub-processor management | 10% | [X.X] | [X.XX] |
| Transfer safeguards | 5% | [X.X] | [X.XX] |
| **TOTAL WEIGHTED SCORE** | **100%** | | **[X.XX]** |

## 7. Sufficiency Decision

| Field | Value |
|-------|-------|
| **Decision** | [APPROVED / CONDITIONALLY APPROVED / REJECTED] |
| **Weighted Score** | [X.XX] / 5.00 |
| **Threshold Met** | [Approved >= 4.0 / Conditional 3.0-3.9 / Rejected < 3.0] |

**Rationale:**
[Detailed explanation of the decision, referencing key strengths and concerns identified during assessment.]

**Conditions (if Conditionally Approved):**
1. [Condition 1 with deadline]
2. [Condition 2 with deadline]

## 8. Reassessment Schedule

| Field | Value |
|-------|-------|
| **Next Reassessment Date** | [YYYY-MM-DD] |
| **Reassessment Type** | [Full / Abbreviated] |
| **Trigger-Based Review Conditions** | Vendor breach, certification lapse, material service change, regulatory action |

## 9. Approvals

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Assessor | [Name] | __________ | [Date] |
| DPO / Privacy Lead | [Name] | __________ | [Date] |

---

*This assessment was conducted pursuant to GDPR Article 28(1) and documented per the Article 5(2) accountability principle. The complete due diligence file is retained in the Summit Cloud Partners Vendor Management System.*