Supplier privacy and security questionnaire

How to use this

Send this before you sign. Scale it to the risk. A newsletter tool holding email addresses needs the short version, while a system holding health records needs every question answered with evidence. Our guide to suppliers, cloud and overseas explains why each question matters.

Supplier privacy and security questionnaire

Supplier: [name] Service: [description] Personal information involved: [what, whose, roughly how many people] Completed by (supplier): [name, role, date]

Short version (every supplier)

1. Will you use our data, or data about our customers or staff, for any purpose of your own? This includes product improvement, analytics, advertising and training AI models.
2. Where will the data be stored and processed? Name the countries.
3. Which sub-processors will have access to it? How will you tell us about changes?
4. Is multi-factor authentication available and enforced for all accounts, including your staff’s?
5. How quickly will you notify us of a security incident affecting our data, and what information will you give us?
6. How do we get our data back, and how do you delete it, when the contract ends?

Full version (sensitive information or large volumes)

Security

7. What independent security certifications or audit reports do you hold (for example ISO 27001, SOC 2)? Please provide the latest.
8. Is data encrypted in transit and at rest? Who manages the keys?
9. How do you control and log your staff’s access to our data?
10. How often do you test security (penetration tests, vulnerability scanning), and what did the last test find?
11. Have you had a security incident affecting customer data in the last three years? What happened and what changed?

Privacy

12. Can you help us respond to access and correction requests within 20 working days?
13. Can you apply our retention periods and delete specific records on request?
14. Do you have a privacy officer or equivalent we can contact?
15. If the service involves AI or automated processing, how is it tested for accuracy and bias, and can a human review outputs?
16. If the service involves biometric processing, how will you support our obligations under the Biometric Processing Privacy Code?

Resilience

17. How is data backed up, where, and how often is restoring tested?
18. What happens to our data if your business is sold or closes?

Contract terms to require

• [ ] Supplier acts only on our instructions and doesn’t use the data for its own purposes.
• [ ] Security obligations proportionate to the data.
• [ ] Breach notification to us within [24 / 48] hours, with ongoing updates.
• [ ] Approval or notice for new sub-processors and changes in storage location.
• [ ] Help with access, correction and deletion requests.
• [ ] Return and certified deletion at the end of the contract.
• [ ] Right to audit, or to receive independent assurance reports.
• [ ] Where information will be disclosed overseas for the supplier’s own use, IPP 12 safeguards (the Privacy Commissioner publishes model clauses).

Our assessment

Risk rating: [low / medium / high] Conditions or actions before signing: [list] Approved by: [name, date] Review date: [annually for high-risk suppliers]