Data Processor Due Diligence Checklist

Purpose and scope

A controller remains responsible for choosing processors that provide sufficient guarantees for UK GDPR compliance. Due diligence should therefore assess the processor before appointment and at suitable intervals, with the depth of review reflecting the type and volume of personal data, the processing activities and the potential harm from a failure. Harper James is a UK full-service commercial law firm advising businesses on data protection and related commercial matters under the laws of England and Wales.

Information to request

A practical checklist should cover:

• Processing details: the data categories, data subjects, purposes, locations, retention periods and documented processing instructions.
• Contract terms: a UK GDPR-compliant data processing agreement covering confidentiality, security, sub-processors, assistance with individual rights, breach notification, impact assessments, audits and deletion or return of data.
• Security controls: access management, encryption, staff training, vulnerability management, backups, business continuity and incident response.
• Sub-processors: the identity, role, location and approval process for each sub-processor, including notice of proposed changes.
• International transfers: transfer mechanisms and safeguards where personal data leaves the United Kingdom, together with the relevant transfer risk assessment where required.
• Evidence: independent assurance reports, security certifications, policies, audit summaries, penetration-test information and records of material data breaches.

Assessing the responses

The review should compare the processor’s evidence with the risks identified in the controller’s records, including its data protection impact assessment where one is required. Check whether the proposed services match the written processing instructions, whether the processor can meet contractual response times for data breaches and individual rights requests, and whether its deletion and exit arrangements are workable. Unsupported assurances should be recorded as gaps rather than treated as completed checks.

Approval and ongoing monitoring

Record the decision, the evidence reviewed, identified risks, contractual protections, owners and review dates. Approval should be conditional on resolving material gaps or accepting them at the appropriate management level. After appointment, monitor changes to services, sub-processors, processing locations, security arrangements and regulatory requirements. Repeat the review after a significant change, a serious incident or a material change in the processing risk.