Start with scope
Suggested workflow. Apply specific legal and contractual requirements to the actual service, data and parties.
Understand the relationship
Name the service owner, business purpose, criticality, users, data, locations and dependencies. Consider whether the supplier is replacing an existing control or creating a new one.
Working output: A scoped service and data-flow description.
Gather proportionate evidence
Review the supplier’s identity, relevant competence, financial stability, security and continuity evidence. Evaluate dates, scope and exclusions in certifications or reports.
Check subcontractors, support access and international data arrangements where relevant. A questionnaire answer is a supplier claim until supported.
Working output: A due-diligence record that distinguishes evidence from assertions.
Make the contract and decision usable
Resolve accountability, incident notification, service levels, access rights, subcontracting, termination and data return or deletion. Route specialist questions for review.
Record gaps, mitigations, residual risk and the person authorised to accept the relationship.
Working output: A reasoned approval or deferral, with conditions and owners.
Monitor and plan for exit
Agree review triggers, evidence refresh, incidents and service-performance checks. Test continuity dependencies where proportionate.
Define who can terminate, how the service continues and what evidence is needed for return, transfer or deletion of information.
Working output: A monitoring calendar and workable exit record.
Guidance and underlying sources
- Review suppliers across the whole relationship — includes the primary sources and applicability limits.
- UK GDPR accountability and DPIA triage — includes the primary sources and applicability limits.
- Practise disruption before it becomes a crisis — includes the primary sources and applicability limits.