# Vendor Privacy Risk Scoring — Assessment Worksheet

## Vendor Information

| Field | Value |
|-------|-------|
| **Vendor Name** | [Vendor Legal Name] |
| **Vendor ID** | [Internal ID] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessment Type** | [Initial / Recalculation / Escalation] |
| **Scored By** | [Name, Title] |
| **Approved By** | [Name, Title] |

## Dimension Scoring

### D1: Data Volume (Weight: 15%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | < 100 data subjects | [ ] |
| 2 | 100 – 1,000 data subjects | [ ] |
| 3 | 1,001 – 10,000 data subjects | [ ] |
| 4 | 10,001 – 100,000 data subjects | [ ] |
| 5 | > 100,000 data subjects | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D2: Data Sensitivity (Weight: 25%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | Pseudonymized non-sensitive data only | [ ] |
| 2 | Non-sensitive personal data (names, email) | [ ] |
| 3 | Behavioral data, location, financial identifiers | [ ] |
| 4 | Government IDs, precise geolocation, communications | [ ] |
| 5 | Special category (Art. 9) or criminal (Art. 10) | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D3: Transfer Locations (Weight: 15%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | EEA only | [ ] |
| 2 | EEA + adequacy countries only | [ ] |
| 3 | Non-adequate with SCCs + supplementary measures | [ ] |
| 4 | Surveillance-risk jurisdictions | [ ] |
| 5 | No valid transfer mechanism | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D4: Certifications (Weight: 15% — Inverse)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | ISO 27001 + ISO 27701 + SOC 2 Type II + sector cert | [ ] |
| 2 | ISO 27001 + SOC 2 Type II | [ ] |
| 3 | ISO 27001 OR SOC 2 Type II (single) | [ ] |
| 4 | Self-assessment or CSA STAR Level 1 only | [ ] |
| 5 | No recognized certifications | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D5: Breach and Enforcement History (Weight: 10%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | No breaches, no enforcement (5 years) | [ ] |
| 2 | Minor incident(s) with prompt response | [ ] |
| 3 | One significant breach, adequate response | [ ] |
| 4 | Multiple breaches or one enforcement action | [ ] |
| 5 | Major enforcement or pattern of non-compliance | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D6: Control Maturity (Weight: 10%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | Optimized — continuous improvement, automated | [ ] |
| 2 | Managed — measured, monitored, regularly tested | [ ] |
| 3 | Defined — documented, periodically tested | [ ] |
| 4 | Developing — basic controls, gaps in docs | [ ] |
| 5 | Initial — ad hoc, minimal documentation | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

### D7: Processing Autonomy (Weight: 10%)

| Score | Criterion | Applicable? |
|-------|-----------|:-----------:|
| 1 | No discretion — purely technical execution | [ ] |
| 2 | Limited — predefined processing options | [ ] |
| 3 | Moderate — processor selects technical means | [ ] |
| 4 | Significant — processor defines processing logic | [ ] |
| 5 | High — approaches controller boundary | [ ] |

**Score Assigned:** [1-5]
**Justification:** [Evidence-based rationale]

## Weighted Score Calculation

| Dimension | Weight | Score | Weighted |
|-----------|--------|-------|----------|
| D1: Data Volume | 15% | [X] | [X.XX] |
| D2: Data Sensitivity | 25% | [X] | [X.XX] |
| D3: Transfer Locations | 15% | [X] | [X.XX] |
| D4: Certifications | 15% | [X] | [X.XX] |
| D5: Breach History | 10% | [X] | [X.XX] |
| D6: Control Maturity | 10% | [X] | [X.XX] |
| D7: Processing Autonomy | 10% | [X] | [X.XX] |
| **TOTAL** | **100%** | | **[X.XX]** |

## Risk Tier Assignment

| Tier | Range | Current Score | Assigned? |
|------|-------|:------------:|:---------:|
| Tier 1 — High Risk | 3.5 – 5.0 | [X.XX] | [ ] |
| Tier 2 — Standard Risk | 2.5 – 3.4 | [X.XX] | [ ] |
| Tier 3 — Low Risk | 1.0 – 2.4 | [X.XX] | [ ] |

**Override Applied:** [Yes / No]
**Override Reason:** [If applicable]

## Oversight Schedule

| Activity | Frequency | Next Due |
|----------|-----------|----------|
| Due diligence refresh | [Per tier] | [Date] |
| Privacy audit | [Per tier] | [Date] |
| Sub-processor review | [Per tier] | [Date] |
| DPA review | [Per tier] | [Date] |
| Risk recalculation | [Per tier] | [Date] |

## Score History

| Date | Score | Tier | Change Reason |
|------|-------|------|---------------|
| [Date] | [X.XX] | [Tier] | [Reason] |

## Approvals

| Role | Name | Date |
|------|------|------|
| Scorer | [Name] | [Date] |
| Approver | [Name] | [Date] |