Third-party risk management and processor oversight

Why supplier oversight is no longer optional

Signing the data processing agreement and filing it away is not enough. The General Data Protection Regulation requires you to use «only processors providing sufficient guarantees». The contract must also allow the controller to carry out «audits, including inspections». In other words, the law assumes that you will check what your supplier does.

The Spanish Data Protection Agency (AEPD) enforces it. In 2021 it fined Vodafone €8 million, €4 million of which was for failing to supervise the processors and sub-processors running marketing campaigns on its behalf. In 2024 it fined a hospital group €200,000 for security failures at the supplier hosting its electronic health records. In that decision it noted that the controller is ultimately responsible for the measures, even when the system belongs to a third party.

Cybersecurity regulation points the same way:

• NIS2. The EU directive lists «supply chain security» among the mandatory measures. Many companies in scope already pass that requirement on to their suppliers through questionnaires and clauses.
• DORA. Since 17 January 2025, banks, insurers and other financial entities must keep a register of their ICT providers.
• ISO 27001. The standard devotes several controls to supplier relationships. Certified companies must show that they assess and monitor their suppliers.

How we manage third-party risk

1. Inventory and risk classification

First we identify every supplier with access to personal data or to your systems. We then classify them by type of data, volume, system access, data location and how critical the service is to your business, so that effort goes where the risk is.

2. Review of contracts and sub-processors

We check that each data processing agreement includes what the law requires: instructions, confidentiality, security measures, sub-processors, audits and return or deletion of data at the end. Where something is missing, we draft the agreement or addendum. Our guide to the data processing agreement under the GDPR explains what it must contain.

3. Questionnaire and evidence

We send each supplier a questionnaire tailored to its risk level and request evidence: certifications such as ISO 27001 or Spain’s National Security Scheme, security policies, the list of sub-processors, server location and safeguards for international transfers. We also chase those who do not reply.

4. Risk report and action plan

For each supplier we issue a clear rating: acceptable, acceptable with measures, or not acceptable. We also set out what needs to be requested or corrected, and by when.

5. Ongoing monitoring

We review suppliers every year and whenever something relevant changes: a new sub-processor, a security breach or a change of service. That way oversight never becomes a one-off snapshot.

6. Central register

All the information is kept organised on our compliance platform: contracts, questionnaires, evidence, ratings and review dates. If the authority, an auditor or a client asks for it, you have it ready.

Three levels of third-party risk management by risk

• Basic: for low-risk suppliers, such as services that barely handle contact details. We review the contract and obtain a compliance statement.
• Standard: for most suppliers with access to client or employee data. We add the questionnaire, evidence review and risk rating.
• Critical: for suppliers handling health data, children’s data or large-scale processing, or supporting essential systems. We carry out an in-depth review, with a meeting with the supplier and a detailed action plan.

So you neither pay for an in-depth review of a low-risk supplier nor fall short with the ones that really matter. We send you a fixed proposal based on the number of suppliers and their level.

What you get

• Supplier inventory classified by risk level.
• Data processing agreements reviewed and, where missing, drafted.
• Questionnaires and evidence for each supplier, on file.
• Risk report for each supplier with its action plan.
• Review calendar and alerts when renewals are due.
• Documentation ready to demonstrate your diligence to the authority, an ISO 27001 auditor or a client.

Who this service is for

• Mid-sized companies working with dozens of suppliers and without a risk or procurement team to oversee them.
• Schools and educational centres, which entrust children’s data to learning platforms, catering and activity providers.
• Clinics and healthcare companies, because of health data.
• Companies preparing for ISO 27001 or Spain’s National Security Scheme certification.
• Suppliers to companies subject to NIS2 or DORA that receive questionnaires from their clients and need to answer them convincingly.

What we do not do

We do not certify your suppliers or guarantee their security: only an accredited certification body can do that. Our job is to verify the documentation and guarantees they provide, assess the risk and monitor them, so that you can show you acted diligently.

Frequently asked questions about third-party risk management

Is third-party risk management mandatory?

Yes, where personal data is concerned. The GDPR requires you to use processors with sufficient guarantees and allows you to audit them, and the AEPD has fined controllers for their suppliers’ failures.

Is signing the data processing agreement enough?

No. The contract is necessary, but the authority also expects you to check, throughout the relationship, that the supplier applies the measures it committed to.

How often should a supplier be reviewed?

As a guide, once a year and whenever there is a relevant change. Critical suppliers may need more frequent monitoring.

What if a supplier does not respond?

We follow up through the channels agreed in the contract and, if there is still no reply, record it in the report as an unverified risk. We then propose alternatives: enforcing it through the contract, limiting the data it receives or changing supplier.

Does it replace an on-site audit?

Not always. For most suppliers a documentary review is sufficient and proportionate. For critical ones, the report states whether an on-site audit is advisable.

For the full picture, read our guide to third-party risk management.