How Do You Check a Vendor's Privacy Policy Against UU PDP and GDPR?
CyberRank Research
Use a fixed checklist: purposes, legal bases, retention, data subject rights, sub-processors, transfers and a contact point, then compare it with what the vendor's site actually does, such as its cookie banner. Gaps in a public policy often signal gaps in practice. CyberRank splits a vendor's policy into 15+ areas and flags each gap with a suggested rewrite.
TL;DR
- A privacy policy is public evidence of how a vendor says it handles personal data, which you can check before you sign.
- The most common gaps are missing retention periods, unnamed sub-processors, vague legal bases and consent that is hard to refuse.
- CyberRank checks the policy and cookie consent against GDPR and UU PDP indicators and reports each gap in plain language.
What should a vendor privacy policy contain?
At least the eight items below. Each one maps to a transparency duty under GDPR, UU PDP or both.
The policy is one of seven areas in a full review, as explained in our guide to vendor privacy risk assessment. Treat it as a claim: the vendor's site should behave the way the policy says.
| Item | What good looks like | Common gap | How CyberRank helps |
|---|---|---|---|
| Purposes | What good looks likeSpecific purposes per data category | Common gap"To improve our services" with no detail | How CyberRank helpsFlags vague or missing purposes |
| Legal basis | What good looks likeA stated basis for each purpose, such as contract or consent | Common gapNo basis named, or consent used for everything | How CyberRank helpsChecks GDPR and UU PDP indicators |
| Retention | What good looks likeA period or rule for each data category | Common gap"As long as necessary" | How CyberRank helpsFlags missing retention |
| Data subject rights | What good looks likeAccess, correction, deletion, objection, and how to use them | Common gapRights listed with no channel | How CyberRank helpsFlags missing rights or contact routes |
| Sub-processors | What good looks likeNamed categories or a list, with a change process | Common gapNot mentioned | How CyberRank helpsFlags missing sub-processor disclosure |
| International transfers | What good looks likeDestination countries and safeguards | Common gapSilent on transfers | How CyberRank helpsPairs with the data residency check |
| Consent and cookies | What good looks likeSpecific, informed consent that is as easy to refuse as to give | Common gapPre-ticked boxes or no reject option | How CyberRank helpsAssesses the cookie consent banner |
| Contact point | What good looks likeA privacy contact or data protection officer | Common gapOnly a general support address | How CyberRank helpsFlags missing contact details |
Example: a payroll provider with a short policy (fictional)
A fictional Indonesian payroll SaaS publishes a one-page policy and passes its security review.
The policy names no retention period, does not mention sub-processors, and says data "may be stored outside Indonesia" without naming countries or safeguards. Its cookie banner has an Accept button but no Reject option. Under UU PDP, payroll data includes identity numbers and financial details, so these gaps matter for a controller that must choose processors carefully; the obligations are summarised on our UU PDP page.
The sensible next step is not to reject the vendor, but to turn each gap into a targeted question and a contract clause, then check where its systems are actually hosted, as explained in data residency vs data sovereignty.
How CyberRank helps: CyberRank finds these gaps from the vendor's web address, explains each one, and suggests rewrites the vendor can use. It is a quick way to triage policies before deeper work, as described in the main vendor privacy guide.
Where CyberRank does not help
CyberRank reads what a vendor publishes. It cannot confirm that the vendor follows its own policy, that retention periods are enforced, or that the sub-processors it names are complete. It does not give a legal opinion on whether the policy meets GDPR or UU PDP. Use targeted questions, the processor agreement and legal review for that.
References
Frequently asked questions
Check a vendor's privacy policy
See policy gaps, consent issues and suggested rewrites for any supplier, from just a web address.
Check a vendor's privacy policy