Third-party risk management (TPRM) means knowing which suppliers process your data or access your systems, what risk each one poses and how you keep it under control. For years it was seen as something only large corporations had to worry about. Not any more: the GDPR, the NIS2 Directive, the DORA Regulation and the ISO 27001 standard all require it, each in its own way. This guide explains what each framework asks for, what the Spanish Data Protection Agency (AEPD) has fined companies for, and a practical method to apply it in a mid-sized company.
In this article we will discuss...
What third-party risk management is
A third party is any external company or professional that provides a service to your organisation: your accountants, your software vendor, the cloud, IT maintenance, the security company or the call centre. Many of them process personal data on your behalf; in GDPR terms, they are processors.
Third-party risk management has four stages:
- Before signing: check that the supplier provides sufficient guarantees.
- When signing: put those guarantees in writing.
- During the service: verify that the supplier meets them and react to changes or incidents.
- At the end: make sure the supplier returns or deletes the data.
In other words, third-party risk management is not a one-off formality but a cycle that repeats for as long as the relationship with each supplier lasts.
Why signing a data processing agreement is no longer enough
Many companies believe that once the data processing agreement is signed, responsibility passes to the supplier. It does not. Article 28(1) GDPR states that the controller «shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures». Recital 81 spells those guarantees out: «expert knowledge, reliability and resources».
The same article requires the contract to oblige the processor to allow for and contribute to «audits, including inspections, conducted by the controller or another auditor mandated by the controller». The law therefore assumes that the controller will check.
The AEPD has applied this in two cases worth knowing:
- Vodafone (2021). The Agency fined the company €8 million in total. Of that, €4 million was for breaching Article 28 in connection with Article 24: it failed to supervise the processors and sub-processors running marketing campaigns on its behalf. According to published analyses of the decision, the Agency stressed that a processor’s guarantees must be assessed throughout the relationship, not only when it is chosen.
- Hospital group (2024). The AEPD imposed a €200,000 fine for inadequate security measures. The failures were in the system of the supplier hosting the electronic health records: it did not log consultations, permissions were poorly defined and encryption was partial. Even so, the fine fell on the hospital, as the party ultimately responsible for ensuring the measures were effective.
The lesson for third-party risk management is clear: if a supplier fails and you cannot show that you chose and monitored it diligently, the risk is yours.
What each framework requires for third-party risk management
GDPR: sufficient guarantees and a complete contract
Beyond the guarantees, the data processing agreement must cover the subject matter and duration of the processing, instructions, confidentiality, security measures, the rules on sub-processors, assistance to the controller, return or deletion of the data at the end, and audits. We go through it clause by clause in our guide to the data processing agreement under the GDPR.
If the supplier in turn uses another provider (a sub-processor), it needs your prior authorisation and must impose the same obligations on it. If data is transferred outside the European Economic Area, you also need to check which safeguards the transfer relies on.
NIS2: supply chain security
The NIS2 Directive requires essential and important entities to adopt risk-management measures. These expressly include «supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers».
In Spain, as of the date of this guide (October 2026), the law transposing it has not yet been published in the Official State Gazette (BOE). The effect is already visible, however: companies subject to NIS2 in other countries, and Spanish companies preparing for it, routinely send security questionnaires to their suppliers and add clauses to their contracts.
DORA: register of ICT providers in the financial sector
The DORA Regulation has applied since 17 January 2025 to banks, insurers, asset managers and other financial entities. It requires them to manage the risk posed by their ICT service providers and to keep a register of all contracts with them. As a result, any company providing technology services to a financial entity should expect detailed questions.
ISO 27001: specific supplier controls
The 2022 version of ISO 27001 devotes several controls to suppliers: information security in supplier relationships, agreements, the ICT supply chain, monitoring and change management, and the use of cloud services. That is why companies preparing for certification soon find that they need a supplier assessment process.
A six-step method for third-party risk management
Below is a proportionate method designed for a mid-sized company without a risk department. It focuses on what matters and keeps each step documented.
1. Build a complete inventory
Start from invoices and contracts, not from memory. Also review the tools each department uses: it is common to find cloud services paid for by card with no data processing agreement at all.
2. Classify by risk
Not every supplier deserves the same effort. To classify them, consider these criteria:
- Type of data: health, children’s, financial or just contact details.
- Number of people affected.
- Access to your systems or only to specific data.
- Where the data is stored and any international transfers.
- Use of sub-processors.
- How critical the service is: what would happen if it stopped working.
Using these criteria, split your suppliers into three tiers: low, medium and critical.
3. Check guarantees before signing
For medium and critical suppliers, send a questionnaire and ask for evidence. Then assess the answers before you sign, not afterwards.
4. Sign a complete contract
Check that the data processing agreement covers everything the GDPR requires. For critical suppliers, also add deadlines for reporting security breaches, the right to audit and an exit plan.
5. Monitor
Review each supplier at least once a year, and also whenever something relevant changes: a new sub-processor, a security breach, a change of service or news affecting its solvency. If a supplier suffers a breach, you must also assess whether you need to notify it; see our page on data breach management under the GDPR.
6. Plan the exit
When the service ends, ask the supplier to return or delete the data and to confirm it in writing. This is the most frequently forgotten stage, which is precisely why it should be provided for in the contract.
Basic third-party risk management questionnaire
These are the questions that any medium- or critical-risk supplier should answer as a minimum. Then adapt the questionnaire to the specific service.
- What personal data will you process, and for what purpose?
- Where is the data hosted? Are there transfers outside the European Economic Area?
- Do you use sub-processors? Which ones, and for what?
- Do you hold security certifications (ISO 27001, Spain’s National Security Scheme or others)? What is their scope and expiry date?
- How do you control which of your staff access our data?
- Do you encrypt data in transit and at rest?
- Do you log access and consultations, not just changes?
- Do you make backups and test them?
- How quickly will you notify us of a security breach?
- Have you suffered any significant incidents in recent years?
- What will you do with our data when the contract ends?
- Do you agree to be audited by us or by a third party on our behalf?
Question seven is no accident: the failure to log consultations was one of the shortcomings the AEPD criticised in the hospital group case.
What evidence to request
- Valid security certificates and their scope: a certificate that does not cover the service you are buying is of little use.
- Security policy or a summary of the measures in place.
- Up-to-date list of sub-processors.
- Information on where the data is stored and the safeguards for international transfers.
- External audit reports, if available.
- Security breach management procedure.
The supplier register in third-party risk management
Third-party risk management rests on a simple, up-to-date register. You do not need expensive software: what matters is that each supplier has a record and someone keeps it current. As a minimum, include these fields:
- Supplier name and service provided.
- Personal data accessed and people affected.
- Risk tier assigned, and why.
- Data processing agreement: date signed and version.
- Known sub-processors.
- Data location and any international transfers.
- Certifications provided and their expiry dates.
- Date of the last review and of the next one.
- Incidents or breaches reported.
- Person in your company responsible for that supplier.
This register also connects with your record of processing activities: each activity must state which processors are involved, so it makes sense to keep both aligned.
Worked example: a company with 40 suppliers
Imagine a services company with 40 suppliers. After the inventory, the split might look like this (an illustrative example, not a rule):
- 25 low risk: couriers, office supplies or services that barely handle contact details. Reviewing the contract and obtaining a compliance statement is enough.
- 12 medium risk: accountants, invoicing software, CRM or bulk email tool. Here you need a questionnaire, evidence and an annual review.
- 3 critical: the cloud holding all the company’s information, the payroll software and the provider handling employees’ health data. These call for an in-depth review, a meeting with the supplier and an action plan with deadlines.
The company thus focuses its effort on 15 suppliers instead of chasing all 40 with the same questionnaire. That, ultimately, is what third-party risk management is about: proportionality.
Common mistakes in third-party risk management
- Thinking that the data processing agreement shifts all responsibility to the supplier.
- Controlling only the large suppliers and forgetting the small tools each department uses.
- Sending the same long questionnaire to every supplier, so that many never answer.
- Accepting a certificate without checking its scope or date.
- Reviewing at signing and never looking again.
- Not keeping evidence: if you cannot prove the control, for practical purposes it does not exist.
And if you are the supplier
Third-party risk management has a flip side. If your company provides services to others, you will receive more and more security and data protection questionnaires, especially from clients in the financial sector or companies preparing for NIS2. Answering them well, with organised evidence, has become a commercial advantage that can decide who wins the contract.
Frequently asked questions about third-party risk management
What does TPRM stand for?
Third-Party Risk Management: the process of identifying, assessing and controlling the risks posed by suppliers.
Is third-party risk management mandatory for an SME?
Where personal data is concerned, yes: the GDPR requires every company to use processors that provide sufficient guarantees. NIS2 and DORA apply only to certain entities, but their requirements reach their suppliers through contracts.
How often should suppliers be reviewed?
As a guide, once a year and whenever there is a relevant change. Critical suppliers may need more frequent monitoring.
Can I outsource supplier control?
Yes. You can entrust the inventory, questionnaires, review and monitoring to an external specialist. Responsibility before the AEPD remains yours, however, so the service should keep everything documented.
How Auratech can help
At Auratech we handle supplier and processor oversight from start to finish: inventory, risk classification, contracts, questionnaires, reporting and annual monitoring. We work with three review levels depending on how critical each supplier is, so the effort goes where the risk is. If you also need an overall review, you can combine it with our data protection audit or our outsourced Data Protection Officer service. Tell us how many suppliers you have and we will send you a proposal.
This article provides general information and is not a substitute for legal advice on a specific case.
