Vendor Security Audit: 25 Questions Before Sharing Customer Data
A vendor-security assessment covering data scope, roles, identity, encryption, logs, testing, sub-processors, incident response, resilience, deletion and evidence.
A questionnaire is useful only when answers are tested against contracts, architecture and evidence.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
Future Rule 6 safeguards include processor-contract measures, access control, logs, continuity and breach detection, investigation and remediation.
The Data Fiduciary remains responsible for reasonable safeguards over processing undertaken on its behalf.
Vendor review should be proportional to data and operational criticality rather than contract value.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; Consent Manager-related provisions follow after one year; most operating duties and Rules follow eighteen months after Gazette publication. As of 22 June 2026, the control should distinguish current obligations from future-state DPDP readiness.
- Future Rule 6 safeguards include processor-contract measures, access control, logs, continuity and breach detection, investigation and remediation.
- The Data Fiduciary remains responsible for reasonable safeguards over processing undertaken on its behalf.
- Vendor review should be proportional to data and operational criticality rather than contract value.
- Sub-processors and support access can create material exposure even where primary hosting is secure.
The five-point review
| Check | What to examine |
|---|---|
| Data and role | Fields, purpose, fiduciary or processor status. |
| Identity | SSO, MFA, privileged access and leavers. |
| Security | Encryption, vulnerability management and logging. |
| Resilience | Backups, RTO/RPO and incident support. |
| Exit | Export, deletion, certification and lock-in. |
Practical example
A low-cost support plugin receives customer emails and attachments but has no MFA, short logs and unclear sub-processors. Its low annual fee does not make the data risk low.
How to apply the framework
Require evidence for high-risk answers: sample logs, audit reports, penetration summary, deletion procedure and incident template.
Track remediation and expiry. A vendor approved three years ago should not remain trusted after material architecture or ownership change.
Operating workflow
Define the real process before selecting the legal label
Identify the people, data, systems, purpose, owner, processor, user journey and failure scenario. Review data and role, identity and security together. A policy statement or vendor assurance cannot replace evidence of how the live product behaves.
Separate current obligations from scheduled DPDP controls
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative CERT-In, banking, telecom, insurance, employment, consumer, contract and criminal-law requirements. Build the scheduled DPDP workflow now, but do not describe a future provision as already enforceable.
Test and preserve evidence
Run the workflow in the live or controlled test environment. Preserve screenshots, approvals, logs, vendor responses, user communications, exceptions and remediation. Assign a named owner and completion date to every failed control so management can distinguish an operating safeguard from a policy intention.
Action checklist
- Classify vendor risk.
- Confirm data and purpose.
- Test identity and logs.
- Review sub-processors and location.
- Assess incident and continuity.
- Contract and verify exit.
Evidence to keep
- Questionnaire and evidence
- Architecture and data-flow map
- Audit or test reports
- DPA and incident terms
- Remediation and deletion records
Warning signs
- Yes/no answers without evidence
- No MFA for administrators
- Unknown sub-processors
- No breach-notice clock
- Deletion cannot be demonstrated
Finin2min takeaway
Privacy and cyber maturity are visible in operating behaviour: what the organisation collects, who can use it, how vendors are controlled, how users exercise choices, how incidents are handled and whether evidence survives scrutiny.