Vendor Risk Assessment

How This Template Accelerates Your Audit & Career

Third-Party Vendor Risk Assessment Purpose: a Data Fiduciary remains responsible for complying with the Act and Rules in respect of any processing it does "or on its behalf by a Data Processor" (Act S.8(1)), irrespective of any agreement to the contrary, and may only engage a processor "under a valid contract" (Act S.8

This is NOT the contract. The Data Processing Agreement (data-processing-agreement-template.docx) is the signed legal document with binding clauses. This tool is the due-diligence scorecard that tells you whether a vendor deserves that contract in the first place, and whether it still does at renewal. How it works: the