Vendor management
Maintain a complete register of third-party vendors and processors. Track contracts and reviews, classify risk tiers, and bring in what each vendor states publicly from its profile in the vendor catalog.
Vendor register
Your vendor register is the central record of all third parties that process personal data on your behalf. Each vendor entry captures contact details, processing purposes, contract status, and risk tier.
ACTIVE
Vendor is approved and actively processing data
UNDER REVIEW
Vendor is being evaluated or re-assessed
SUSPENDED
Processing suspended pending issue resolution
OFFBOARDED
Vendor relationship terminated, data return/deletion confirmed
Risk tiers
Vendors are classified into risk tiers based on the volume and sensitivity of data they process, their security posture, and geographic considerations.
LOW
MEDIUM
HIGH
CRITICAL
Higher-risk vendors require more frequent reviews, stronger contractual safeguards, and may trigger a vendor risk assessment.
Vendor dashboard
Get an overview of your vendor landscape at a glance.
24
Total vendors
18
Active
3
High risk
5
Pending review
Contract management
Track Data Processing Agreements (DPAs), Standard Contractual Clauses (SCCs) and other contractual documents for each vendor. Record renewal and end dates: contracts close to expiry show on the vendors dashboard.
Key contract documents
Generating a DPA + Transfer Impact Assessment
PrivacyCloud can produce a signature-ready Data Processing Agreement and a standalone Transfer Impact Assessment for any vendor, populated from your own privacy program: the vendor register, submitted questionnaires, and the processing activities that name the vendor as a recipient. Documents are generated in English or Spanish.
Data processing agreement (PDF)
Article 28 controller-to-processor agreement with negotiated terms and Annexes I to IV: description of processing, technical and organizational measures (TOMs), incorporation of the EU Standard Contractual Clauses (with UK Addendum and Swiss adaptations), and the Transfer Impact Assessment. Annexes III and IV appear automatically when the processor is established outside the EEA/UK.
Standalone TIA (PDF)
Annex IV reproduced without modification, preceded by an identification header, ready for disclosure to a supervisory authority on request under Clause 14 of the incorporated SCCs. Follows the six-step framework of EDPB Recommendations 01/2020.
Open the vendor and choose “Produce DPA + TIA”
Privacy officerOn the vendor's detail page, open the Contracts tab and click “Produce DPA + TIA”. Available to Owners, Admins, and Privacy Officers.
Review the pre-filled facts
Privacy officerEvery fact is proposed from your own data and shown for review: nothing goes into the document unseen. Notes explain where each value came from.
- •Data categories come from the vendor's recorded data types; the processing purpose from activities naming the vendor as a recipient.
- •Establishment means where the vendor is established; it is only pre-filled when your register is unambiguous.
- •Choose the negotiated terms (breach window, sub-processor regime, audit rights, liability, governing law) and complete both parties' details.
Confirm any flagged contradictions
Privacy officerIf your answers contradict each other (for example, claiming pseudonymization while transferring directly identifying data), generation is blocked until you explicitly confirm each flagged item.
Generate the documents
Privacy officerThe DPA is stored against the vendor as a contract pending signature. Any remaining fill-in blanks are listed as warnings so you can resolve them before signature.
Download and sign
Privacy officerDownload the DPA and TIA PDFs from the success screen or anytime from the vendor's Contracts tab. Once countersigned, update the contract status to Active.
The generator never overstates your posture
Annex II lists only security measures confirmed against actual audit evidence: certifications alone justify the audits-review safeguard in the TIA, not TOMs warranties. Importer declarations (government requests, breach history) default to “unknown” unless the vendor itself answered. And per EDPB Recommendations 01/2020, the TIA conclusion documents residual risk unless at least one technical supplementary measure is in place.
After generation
The produced DPA implies a compliance calendar: the 12-month TIA re-evaluation, the annual transparency report where government-access commitments were agreed, and the confirmed TOMs' own cadences. The earliest entry automatically pulls the vendor's next review date forward. Generated documents are templates for qualified counsel to review.
Due diligence and the vendor catalog
PrivacyCloud does not send questionnaires to vendors. Vendors state their certifications, sub-processors, data locations and AI capabilities on their profile in the vendor catalog, and PrivacyCloud reads that profile when you link the vendor. The due-diligence templates in Vendors are reference question sets, useful as a checklist while you review a vendor.
Topics the templates cover
Vendor review process
The vendor review lifecycle from onboarding to ongoing monitoring.
Onboarding
Initial assessment
Due diligence
Profile and checklist
Contract
DPA execution
Approved
Active vendor
Periodic review
Annual reassessment
Adding and reviewing a vendor
Add vendor to register
DPONavigate to the Vendor Management module and click 'Add Vendor'. Enter the vendor name, contact details, and processing purpose.
Link its catalog profile
DPOAdd the vendor from the catalog, or link it to its catalog profile, so its certifications, sub-processors and data locations come in from the vendor's own public statements.
Review the vendor
Privacy officerGo through the profile with a due-diligence template as your checklist. Flag any areas of concern and assign a preliminary risk tier.
- •Check security certifications (ISO 27001, SOC 2, etc.)
- •Review sub-processor arrangements
- •Evaluate data transfer mechanisms
Execute contracts
LegalUpload and track the Data Processing Agreement (DPA) and any additional contractual documents.
Approve and schedule reviews
DPOApprove the vendor for active use, and schedule its next review according to its risk tier.
PDF exports
Export your vendor register as a formatted PDF for audits, due diligence reviews, or regulatory submissions.
Vendor register report
Complete vendor inventory with risk tiers, certifications, data categories processed, countries of operation, contract/DPA status, and review schedules. Includes summary statistics and per-vendor detail cards.