How to Evaluate a Vendor's Data Privacy and Compliance Posture: A GDPR and DPDP Checklist

Renting a flat on the strength of the brochure, without reading the lease, works well until the boiler fails. Supplier privacy reviews often follow the same pattern: a polished privacy page, a certificate logo and a signature. This guide shows you how to fix roles, test the data processing agreement, map transfers and align breach clocks under the GDPR and India's DPDP Act. It also covers the questions AI features now raise.

Why the contract matters more than the policy

A privacy policy describes a provider's intentions towards its own users, and it can change at any time. Your real exposure is set by three things: the contract, daily practice and independent proof that the practice is real.

Accountability stays with you. GDPR Article 28 permits a controller to use only processors that give sufficient guarantees. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) allows a data fiduciary to engage a processor only under a valid contract. Verizon's 2025 Data Breach Investigations Report found third parties involved in 30% of breaches, double the previous year.

Fix the roles before reading any clause

Roles decide which obligations apply, so agree them first. Most providers act as processors for your data. Many also act as controllers for some data, such as account details, usage analytics or data used to improve their own models.

• Controller (GDPR) or data fiduciary (DPDP Act): decides why and how data is processed, and carries primary accountability.
• Processor or data processor: acts only on your documented instructions, under a binding contract.
• Sub-processor: processes on the processor's behalf, and under the GDPR needs your authorisation and the same terms.
• Data subject or data principal: the individual, whose rights requests the provider must help you meet on time.

The red flag is a provider that calls itself a processor yet reserves the right to use your data for product improvement or model training. For that use it is behaving as a controller. Establish its legal basis and confirm that your notices to individuals cover it.

Test the agreement against Article 28(3)

GDPR Article 28(3) lists what a processor contract must contain. We recommend using it as the baseline even for data outside the EU, because it is the most widely used template. Note every point where the provider's wording is weaker.

Map transfers and align the clocks

Personal data leaving the EU or EEA needs a transfer mechanism under Chapter V of the GDPR. Common options are the EU-US Data Privacy Framework, adopted on 10 July 2023, and the Commission's standard contractual clauses (SCCs), modernised on 4 June 2021. The Framework covers only US organisations that have joined it.

The DPDP Act permits transfers abroad except to countries the central government restricts by notification. Indian laws offering higher protection, such as sectoral rules, still apply. Ask for a transfer map naming each entity, country and mechanism. Remote support access from another country is also a transfer, and it is the item most often missing.

Breach timelines are where agreements quietly fail. Under GDPR Article 33, a controller must notify the regulator within 72 hours where feasible. India's DPDP Rules require a detailed report to the Data Protection Board within 72 hours. Your provider's notice period decides how much of that window remains.

Consider a hypothetical case. A contract promises notice within 48 hours of the provider confirming a breach, and confirmation takes a day. You learn of the incident some 72 hours after it began, with your own investigation still ahead. Notice within 24 hours of suspicion, with regular updates, leaves a workable window.

Deletion needs equal precision. The DPDP Rules require certain personal data, traffic data and processing logs to be kept for one year, so the provider's schedule must not cut them short. Confirm that the deletion certificate covers logs, backups and AI prompt history.

Put AI data use in writing, then score the result

AI features raise questions a conventional agreement may not answer. Prompts, files and outputs are personal data when they relate to identifiable people. They often flow to a third-party model supplier acting as a further sub-processor. Ask four questions in writing:

• Training use: is customer data used to train models, by the provider or its model supplier, and is that off by default?
• Legal role: if training occurs, who is the controller and on what legal basis?
• Inference location: where does the model run, and does the transfer map include it?
• Prompt retention: how long are prompts and outputs kept, including in monitoring logs?

Then score each area as met, partly met or not met, and record the evidence. The prudent course is to pause the deal on any 'not met' in the first four rows until the contract is corrected.

Two cautions apply. A SOC 2 report, an independent attestation on a provider's controls, speaks to privacy only when the privacy criterion is in scope. And the DPDP Rules, notified on 14 November 2025, phase in over 12 to 18 months, so agreements signed now will be live when the obligations apply.