Vendor data protection due diligence questionnaire
Send this before fieldwork, never instead of it, the questionnaire's job is to tell you where to look, and its most useful output is the set of questions the vendor would not answer straight.
- 7 pages
- 75
- Word and PDF
- 13 September 2026
What it covers
- 1Vendor data protection due diligence questionnaireDPDP / CERT-In / SPDI
Read the opening
The first part of the format, as it downloads. Blanks are highlighted.
Third-party data protection due diligence questionnaire
Issued by | [[Name of the firm], Chartered Accountants], on behalf of [Client name] ("the Company") | ||
Service provider | [Legal name, CIN/registration number] | ||
Services covered | [Description of the services under which personal data is processed] | ||
Delivery locations covered | [Address of each site] | ||
Assessment tier | [Tier 1 / 2 / 3] | Return by | [date] |
Instructions. Answer every question Y (yes, fully), P (partially — explain) or N (no). Where a document is requested, attach it and give its title, version and date in the Evidence column; an answer of Y with no document attached will be recorded as N. Where a question does not apply, answer NA and state why. This questionnaire must be signed by an officer of the service provider. Incomplete returns will be treated as a refusal to provide information and reported accordingly to the Company's Board.
A · Governance and accountability