Vendor Privacy Diligence

Vendor Privacy Diligence

Purpose

Produce a structured, attorney-ready privacy diligence read on a vendor, processor, or sub-processor before contract, at renewal, or when the vendor's role changes. The skill inventories what the vendor's own materials claim about its privacy posture, maps the data the vendor would touch against the client's stated requirements, builds a risk and gap table, drafts the follow-up questions the gaps demand, and packages contract-term asks for the attorney negotiating the DPA. It produces draft legal work product for attorney review — not legal advice and not a vendor approval.

This skill evaluates diligence materials, not the vendor's actual practices: every posture statement in the output is an attributed claim from a provided document, never a verified fact. The skill never concludes that a vendor is compliant, safe, or approved — engagement decisions belong to the client, on counsel's advice.

Use When

• Procurement or a business team proposes a new vendor or tool that will process personal data, and counsel wants a privacy read before contracting.
• A vendor's completed security or privacy questionnaire has come back and needs to be organized against the client's requirements.
• A vendor is being re-reviewed at renewal, after an incident, after an acquisition, or because its role or the data scope has expanded.
• A processor proposes a new sub-processor and the client's approval workflow requires a diligence pass.
• Counsel wants a follow-up question list and contract-term asks assembled before DPA negotiation begins.
• Diligence on a transaction surfaced a target's key vendors and the privacy posture of each needs a first-pass organization.

Required Inputs

• The vendor diligence materials — completed questionnaires, certification summaries or attestation reports, privacy notices, sub-processor lists, security summaries, data-flow descriptions, or the vendor's trust-center exports. Work only from what is provided; a vendor described from memory or reputation is not diligence.
• What the vendor will process — the data categories, data subject groups, and processing purposes, as stated by the user or the documents. If the data scope is unstated, flag [CONFIRM: data scope] and treat scope-dependent findings as provisional.
• The client's requirements baseline — internal vendor-privacy standards, a diligence checklist, or requirements stated inline by the user. If no baseline is provided, say so, organize the review around the gaps the materials themselves reveal, and flag every "requirement" framing as [CONFIRM: client requirement] — do not invent a standard the client never adopted.
• The engagement context — what the vendor is hired to do and the client's own role for this processing (controller, processor, or both). The same vendor answer can be fine for one role and a gap for the other.
• Optional: the draft contract or DPA, if one exists — reviewed here only to note where diligence findings should become negotiated terms; the document review itself belongs to dpa-review.
• Optional: the prior diligence file for renewals — so the output can record what changed.
• Optional: the practice group's practice-profiles/privacy.md if it has been populated and is loaded alongside this skill. If present, use its Standard Positions and Escalation Thresholds to benchmark vendor answers; if absent, proceed without profile benchmarking.