Service · Vendor & Third-Party Risk

The breach is most likely to come from a vendor.

Your organisation processes personal data through dozens — sometimes hundreds — of third parties. The regulator does not care which one had the breach. The regulator looks at you, and asks whether you knew the vendor existed, whether the contract held, and whether the diligence was real. We build the program that lets you answer all three.

~60%
Of material breaches

Of large enterprise data breaches over the past 36 months originated at a third-party processor or sub-processor — not the controller's own infrastructure.Industry breach analyses, 2023 — 2025

Art. 28
GDPR / mirrored in PDPL & DPDP

Controllers carry the obligation to use only processors who provide sufficient guarantees of appropriate technical and organisational measures. The clause has near-equivalents across KSA PDPL, UAE PDPL and India DPDP Act 2023.Mirrored: KSA PDPL Art. 31 · DPDP § 8

SDF
Significant Data Fiduciary

Under DPDP Act 2023, organisations notified as Significant Data Fiduciaries face explicit additional obligations on third-party engagement, breach notification, DPO appointment and audit. Vendor risk is a named pillar of compliance.India DPDP Act 2023 § 10

01 — What we deliver

A working vendor risk program.

The deliverable is not a register that your DPO maintains alone, abandoned within six months. The deliverable is a working program — inventory, classification, diligence pack, contractual library, monitoring cadence, breach-response coordination, offboarding protocol — wired into your procurement and security workflows so it stays alive between audits.

D-01

Vendor inventory & classification

Personal-data-touching vendor inventory built from procurement records, finance ledger, IT system mapping and DSR-flow analysis. Classified by risk tier with a documented methodology your DPO can apply consistently to new vendors.

  • Discovery across 4 — 6 source systems
  • 4-tier classification methodology
  • Sub-processor visibility & mapping
D-02

Onboarding diligence pack

Tiered diligence questionnaires — long-form for Tier 1 / 2 critical processors, short-form for Tier 3 / 4 minimal-data engagements. Diligence outputs flow into the register; gaps surface before contract execution.

  • Long-form Tier 1 — 2 questionnaire
  • Short-form Tier 3 — 4 questionnaire
  • Diligence-to-contract handoff workflow
D-03

Contractual controls & DPA library

Master Data Processing Addendum mapped to the regulators in scope, with jurisdiction-specific Schedule 4 processing-instruction templates and supplementary clauses for sensitive-category, child, or biometric data processing.

  • Master DPA (multi-jurisdiction)
  • Schedule 4 processing-instruction templates
  • Sensitive-category supplementary clauses
D-04

Cross-border transfer mechanism

Per-vendor TIA where the corridor demands it. SCC selection (EU 2021/914 modules), India-specific contractual approach for restricted transfers, KSA PDPL approved mechanisms, intra-group BCR architecture for groups operating regionally.

  • Per-vendor Transfer Impact Assessment
  • SCC selection & module mapping
  • Intra-group BCR architecture (where relevant)
D-05

Ongoing monitoring & attestation

Annual attestation cycle with re-diligence triggers (M&A, sub-processor change, breach event, control-environment shift). Surveillance window for high-risk Tier 1 vendors with quarterly check-ins instead of annual.

  • Annual attestation cycle & calendar
  • Re-diligence trigger criteria
  • Tier 1 quarterly surveillance cadence
D-06

Breach response coordination

Vendor-side breach playbook — notification-receipt protocol, joint investigation governance, regulator notification call (which clock applies, who notifies whom), individual notification scoping where the controller obligation lands on you.

  • Vendor breach notification protocol
  • Joint investigation governance
  • Regulator notification call decision tree
02 — The vendor lifecycle

Six phases, every vendor, every time.

Every vendor that touches personal data moves through the same six-phase lifecycle. The discipline is not in inventing it — it is in actually applying it consistently to new vendors, and reapplying it when the relationship materially changes.

PHASE 01

Discover

Find the vendor. Procurement record, ledger entry, IT integration log — every channel the relationship could have entered through.

PHASE 02

Classify

Risk-tier the vendor. Data category, volume, jurisdiction, role (controller / processor / sub-processor), control surface.

PHASE 03

Diligence

Tier-appropriate diligence pack — Tier 1 / 2 long-form, Tier 3 / 4 short-form. Outputs feed the register and surface contract gaps.

PHASE 04

Contract

DPA execution, Schedule 4 processing instructions, transfer mechanism, sub-processor consent terms. Master library applied; bespoke where the case demands.

PHASE 05

Operate

Annual attestation cycle. Re-diligence on triggers (M&A, sub-processor change, breach). Tier 1 quarterly surveillance.

PHASE 06

Offboard

Documented offboarding — data return / deletion certification, sub-processor wind-down, register update, ongoing-confidentiality terms.

03 — Classification matrix

Four tiers, each with its own discipline.

The vendor risk program treats vendors differently by tier. A SaaS HRIS holding payroll data does not get the same diligence as a coffee-machine-leasing supplier — both are "vendors", but only one is a privacy risk surface. The matrix below is the methodology applied at classification.

Tier & profile Diligence depth Contractual controls Monitoring cadence
Tier 01 Critical processor Critical Sensitive-category data, large volume, primary processor (HRIS, EHR, payroll, customer database)
Long-form questionnaire. SOC 2 Type II / ISO 27701 evidence required. Sub-processor list reviewed. Optional on-site or video walk-through for novel critical engagements. Full master DPA + jurisdiction-specific Schedule 4 + sensitive-category supplementary clauses. Sub-processor consent regime explicit. Transfer mechanism per corridor. Quarterly surveillance window. Annual full re-diligence. Trigger re-diligence on any sub-processor change, M&A event, or material control-environment shift.
Tier 02 Standard processor High Personal data at scale, non-sensitive primary use (CRM, marketing automation, support platform, analytics)
Long-form questionnaire. SOC 2 / ISO 27001 evidence preferred. Sub-processor list reviewed. Diligence reapplied at annual cycle. Master DPA + jurisdiction-specific Schedule 4. Standard sub-processor consent terms. Transfer mechanism per corridor. Annual attestation cycle. Trigger re-diligence on sub-processor or M&A change. No standing surveillance window.
Tier 03 Sub-processor / occasional Standard Limited or occasional personal data exposure, secondary processor, or data-light operational tools
Short-form questionnaire. Self-attestation acceptable. Inheritable diligence from parent processor where applicable. Standard DPA terms. Schedule 4 light. Sub-processor consent at parent level (where Tier 1 / 2 parent already covers). Annual attestation only. Re-diligence on material change at parent processor.
Tier 04 No-data & minimal Minimal Vendor relationship with no personal-data processing in scope, or de minimis incidental exposure
Self-attestation of no-data status. Spot-check during annual cycle. Reclassified up if a privacy-affecting service is added. No-DPA confirmation language in standard procurement contract. Confidentiality terms baseline. Annual self-attestation. Reclassification triggered by service-scope change.

Tiering is set by the methodology, not the relationship. A long-standing vendor that handles sensitive-category data is Tier 01 regardless of how comfortable the procurement team is with them. A new vendor that does not touch personal data is Tier 04 regardless of how strategic the partnership is. The methodology is the methodology.

04 — What good looks like

Eight artefacts, handed to your team.

The full deliverable set at engagement closeout. Each artefact is built to be maintained by your in-house team — methodology documented, templates editable, decision logic explicit. The work survives the engagement.

01

Vendor inventory register

Working register of every personal-data-touching vendor, with role, data categories, classification tier, jurisdiction, contract status, monitoring cadence and named owner.

02

Classification methodology

Documented rules for assigning vendors to Tier 01 — 04 based on data sensitivity, volume, processor role and control surface. Decision tree with worked examples.

03

DPA library & addendums

Master Data Processing Addendum mapped to KSA PDPL, India DPDP, UAE PDPL and GDPR. Jurisdiction-specific Schedule 4 templates. Sensitive-category supplementary clauses.

04

Diligence questionnaires

Long-form (Tier 01 — 02) and short-form (Tier 03 — 04) questionnaires. Mapped to control objectives. Self-attestation forms for Tier 04. Editable template format.

05

Transfer Impact Assessment templates

Per-corridor TIA templates — KSA → India, UAE → EU, India → US, intra-GCC. SCC module-mapping reference. Onward-transfer governance approach.

06

Annual attestation framework

12-month attestation calendar with vendor-by-vendor schedule, attestation request templates, response evaluation criteria, escalation path for non-compliant or non-responsive vendors.

07

Breach coordination playbook

Vendor-breach response protocol — notification receipt, severity rating, joint-investigation governance, regulator notification decision tree, individual notification scoping.

08

Offboarding protocol

Documented offboarding workflow — data return / deletion certification, sub-processor wind-down, register update, ongoing confidentiality, evidence retention for regulator review.

05 — In scope, by archetype

The vendor categories we typically classify.

A working vendor inventory rarely contains fewer than 60 third parties for a mid-size enterprise, and often runs into the hundreds for groups operating across multiple jurisdictions. Below are the categories that consistently appear across the engagements we have run.

Cloud infrastructure

AWS · Azure · GCP · Oracle Cloud

Tier 01 — Critical processor. Cross-border by default; SCCs required.

SaaS platforms

CRM · HRIS · ERP · Support tools

Tier 01 — 02. Often have sub-processors of their own.

Marketing & analytics

Email · Ad-tech · Web analytics · CDP

Tier 02. High-volume processing; consent dependencies.

HR & payroll

Payroll bureau · Benefits · Background

Tier 01. Sensitive-category data; full diligence pack.

Customer support

Helpdesk · Chat · BPO · Outsourced ops

Tier 02. Often involve cross-border BPO arrangements.

Financial services

Payments · KYC · Credit · Tax

Tier 01. Regulated processors; financial-data overlay.

Logistics & fulfilment

Couriers · 3PL · Last-mile · Fleet

Tier 02 — 03. Customer address & tracking data.

Legacy & on-prem

Maintenance · Hosting · Specialist apps

Often missed in modern inventories. Hidden Tier 02 — 03.

06 — How this is delivered

Three engagement shapes.

Vendor risk work is delivered through one of three engagement shapes — depending on whether you need the program built, the program maintained, or specialist input on a one-off basis. We'll recommend the right shape at scoping; you can always change later.

07 — Common questions

Things people ask on first call.

The questions below come up consistently at scoping. If yours is not here, the contact form below is the right place — a senior member of the practice will respond within one working day.

How do you find vendors we don't know we have?
Discovery runs across four to six source systems — procurement records, accounts-payable ledger, IT integration logs, browser/SaaS telemetry, marketing-tag analysis and DSR-flow tracing. We typically find 15 — 25% more vendors than the procurement team had on file. The shadow-IT layer (departmental SaaS subscriptions paid on credit cards) is where most of the missing vendors live.
Do you negotiate DPAs with vendors directly?
For Tier 01 — 02 critical engagements, yes — typically through a tripartite arrangement where your legal team retains primary authority but we draft and run the practitioner-side negotiation. For Tier 03 — 04 we hand the master DPA to your team for execution. The split is documented in the engagement letter and proportioned to the value of practitioner time involved.
What about vendors who refuse to sign our standard DPA?
Common with hyperscale cloud providers, large SaaS platforms and major payment processors — they enforce their own DPA terms and will not sign yours. We map their DPA against our master, identify gaps, and draft supplementary side-letters or addendums for the gaps that matter. Sometimes the answer is "their DPA is acceptable and the gap is non-material"; sometimes it is "this vendor's terms are not acceptable for sensitive-category processing and you need an alternative." We tell you which.
Can you cover sub-processors too?
Yes, with a tiered approach. Tier 01 vendor sub-processors get reviewed individually as part of the parent diligence. Tier 02 sub-processors are inventoried and the parent's sub-processor consent terms are reviewed, but we do not run independent diligence on each. Tier 03 / 04 sub-processors are handled at parent level only. The methodology surfaces sub-processor changes as a re-diligence trigger on the parent.
How often does the register need to be refreshed?
The register is a living document, not an annual artefact. New vendors are added at procurement onboarding (with diligence pack triggered by tier). Existing vendors get full attestation refresh annually, and re-diligence on triggered events. Tier 01 vendors have a quarterly surveillance window. The "annual refresh" model is what fails by month nine; the "trigger-driven plus annual" model survives.
What happens when a vendor has a breach?
The breach playbook governs: notification receipt logged within hours, severity rating assigned by the DPO (or DPOaaS practice lead), joint-investigation governance triggered, regulator notification clock evaluated for each affected jurisdiction (KSA PDPL, India DPDP, UAE PDPL, GDPR — different clocks), individual notification scoping completed. The vendor is the processor; the controller obligation lands on you, and the playbook makes sure the response is fast enough to land it cleanly.
Can you handle the security questionnaires that come back to us?
Yes — when prospects or customers ask you to fill out their vendor diligence questionnaires (SIG, CAIQ, custom forms), we maintain a master answer library and update it across cycles. Typically delivered through a DPOaaS retainer or a project engagement. The benefit accumulates: the library reduces response time on each subsequent questionnaire significantly.
Does this cover security risk too, or just privacy?
The methodology covers privacy-affecting controls, which overlap substantially with security controls (encryption, access management, breach notification, sub-processor governance) but do not extend to full cybersecurity assurance. For the security-only side — pen testing, red-team exercises, control attestation outside privacy scope — that is a separate cybersecurity engagement, sometimes run in parallel.

Vendor risk is where most programs fail first.

A 30-minute scoping call costs nothing. We will tell you honestly what state your vendor risk program is in — and what the right next step is, whether that is a project to build it, a retainer to operate it, or specialist input on a specific vendor question.

Schedule a call