Vendor Privacy Risk Assessment: How to Rate a Supplier's Privacy Posture
CyberRank Research
A vendor privacy risk assessment checks how well a supplier protects the personal data you hand to it, from its published policies to where its systems are hosted. Under the EU's General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU PDP), you answer for the processors you choose. CyberRank rates a supplier's privacy posture from its web address, next to its security posture, on one AAA–D scale.
TL;DR
- A vendor privacy risk assessment looks at a supplier's privacy policy, consent practices, legal terms, hosting locations, governing law and breach history.
- GDPR Article 28 and UU PDP Article 51 make the controller responsible for choosing processors that protect personal data properly.
- Questionnaires capture what a vendor says about privacy at one point in time, which can hide weak policies and risky data locations.
- Outside-in evidence lets you check privacy claims before you sign, and re-check them during the contract.
- CyberRank adds a Privacy sub-rating to every assessment, covering policy, consent, legal terms, data residency and data sovereignty.
What is a vendor privacy risk assessment?
A vendor privacy risk assessment is a structured review of how a third party collects, uses, stores and discloses personal data on your behalf.
It sits between security due diligence and legal review. Security due diligence asks whether the supplier can keep attackers out. Privacy review asks whether the supplier handles data lawfully and transparently, and keeps it where you expect. Both are part of third-party risk management.
The two overlap, but they fail in different ways. A supplier can run a well-hardened platform while bundling consent, hiding its sub-processors or hosting data in a country your policy forbids. The table below separates the common assessment types.
How CyberRank helps: CyberRank reports privacy as a separate Privacy sub-rating, so a strong security score cannot mask a weak privacy posture.
| Assessment type | Main question | Typical evidence | Main gap | How CyberRank helps |
|---|---|---|---|---|
| Security rating | Main questionIs the vendor's internet-facing estate exposed? | Typical evidenceVulnerabilities, TLS, email security, leaked credentials | Main gapUsually silent on lawful data handling | How CyberRank helpsRates security and privacy side by side |
| Privacy questionnaire | Main questionWhat does the vendor say it does with data? | Typical evidenceSelf-reported answers, policies | Main gapRelies on the vendor's own account | How CyberRank helpsSends questionnaires to vendors below your baseline |
| Data protection impact assessment (DPIA) | Main questionDoes a processing activity create high risk to people? | Typical evidenceInternal design and process review | Main gapCovers your processing, not the vendor's posture | How CyberRank helpsNot covered: a DPIA stays your process |
| Vendor privacy risk assessment | Main questionDoes the vendor's observable privacy posture match what you need? | Typical evidencePublished policies, terms, hosting, jurisdiction, breach history | Main gapCannot see internal practice | How CyberRank helpsAutomates the outside-in checks |
Why is vendor privacy risk a legal duty?
Most privacy laws place the burden of choosing processors on the organisation that controls the data, which makes vendor privacy a compliance obligation, not only good practice.
How CyberRank helps: audit-ready reports give a dated record of each supplier's observable privacy posture at the time you assessed it, which is the evidence of how you chose and monitored each processor.
| Law | Requirement | Reference | How CyberRank helps |
|---|---|---|---|
| GDPR (EU) | RequirementControllers may use only processors that give sufficient guarantees of appropriate technical and organisational measures | ReferenceGDPR Article 28(1) | How CyberRank helpsGives outside-in evidence of those guarantees |
| GDPR (EU) | RequirementProcessors need the controller's prior written authorisation to engage sub-processors | ReferenceGDPR Article 28(2) | How CyberRank helpsFlags policies that do not list sub-processors |
| GDPR (EU) | RequirementTransfers outside the EU must meet Chapter V conditions | ReferenceGDPR Articles 44–49 | How CyberRank helpsShows where public hosts are located |
| UU PDP (Indonesia) | RequirementProcessors must process personal data on the controller's instructions | ReferenceUU PDP Article 51(1) | How CyberRank helpsChecks UU PDP indicators in the policy |
| UU PDP (Indonesia) | RequirementProcessors need the controller's written approval before involving another processor | ReferenceUU PDP Article 51 | How CyberRank helpsFlags missing sub-processor disclosures |
| UU PDP (Indonesia) | RequirementCross-border transfers are allowed only under the conditions the law sets | ReferenceUU PDP Article 56 | How CyberRank helpsCompares hosting with your preferred countries |
Indonesian context
UU PDP (Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi) has 76 articles, and its transition period ended on 17 October 2024. Its implementing regulation, PP No. 33/2026, is reported to be in force. As of November 2026, the independent data protection authority the law requires has not yet been established; Komdigi reported on 5 November 2026 that the Presidential Regulation creating it was at its final stage, and Komdigi carries out the supervisory function until then.
In practice, Indonesian controllers already carry processor obligations, even though detailed technical rules from the future authority are still pending. Banks also face supplier duties under OJK rules on IT service providers.
What should a vendor privacy risk assessment cover?
A complete assessment looks at seven areas, and each can be checked at least partly from public evidence.
These areas connect. A supplier hosted in an unexpected country, under foreign courts, with a policy that does not list sub-processors, presents a combined risk larger than any single finding. For the first two areas, see our short answer on how to check a vendor's privacy policy against UU PDP and GDPR. For the two location questions, see data residency vs data sovereignty.
How CyberRank helps: it assesses privacy with the same structure every time, so results compare across vendors.
| Area | What to check | Why it matters | How CyberRank helps |
|---|---|---|---|
| Privacy policy | What to checkPurposes, legal bases, retention, data subject rights, sub-processors, contact details | Why it mattersA vague policy often signals vague practice | How CyberRank helpsSplits the policy into 15+ areas and flags gaps, with rewrite suggestions |
| Consent and cookies | What to checkWhether consent is specific, informed and easy to refuse | Why it mattersBundled consent is a common GDPR and UU PDP weakness | How CyberRank helpsAssesses cookie consent and GDPR and UU PDP indicators |
| Legal terms | What to checkData protection and breach notification clauses in customer-facing terms | Why it mattersMissing clauses weaken your contractual position | How CyberRank helpsReads login and payment-portal terms for customer-protection clauses |
| Data residency | What to checkCountries where the supplier's public systems are hosted | Why it mattersHosting outside approved countries can trigger transfer rules | How CyberRank helpsGeolocates hosts and compares them with your preferred countries |
| Data sovereignty | What to checkGoverning law and courts named in the supplier's terms | Why it mattersDecides where disputes and data access requests are handled | How CyberRank helpsIdentifies governing law and courts and compares them with jurisdictions you accept |
| Breach and leak history | What to checkPast incidents, exposed data types, leaked staff credentials | Why it mattersShows how exposed the supplier has already been | How CyberRank helpsChecks breach databases and credential-leak sources |
| Certifications | What to checkISO/IEC 27701, ISO/IEC 27001, SOC 2 and similar | Why it mattersIndicates a managed privacy or security programme | How CyberRank helpsDetects certifications and lets vendors upload evidence |
Why does privacy belong in the same rating as security?
Because a privacy view built only from questionnaires goes stale and cannot be compared with security scores, so one rating with two separate parts gives a single decision.
Third-party risk programmes often rate security with outside-in tools and handle privacy through questionnaires and contract review. A questionnaire answered at onboarding says nothing about a policy rewritten six months later, and a security score of 82 next to a questionnaire marked "complete" does not add up to one decision.
Putting privacy on the same scale solves both. Privacy findings refresh with every reassessment, and procurement sees one rating with two clearly separated parts. CyberRank's published 360-point methodology splits the budget evenly between security and privacy, so neither dimension dominates the overall grade. Weaknesses deduct capped demerits, and verified certifications such as ISO/IEC 27701 add capped credits. The same applies to AI suppliers, as explained in our article on EU AI Act third-party risk.
How CyberRank helps: if your vendor risk tool reports only security signals, your privacy view depends entirely on what vendors tell you; CyberRank treats privacy as half of every rating.
How to run a vendor privacy risk assessment
Classify the data, set acceptance rules, run an outside-in assessment, compare findings with your rules, ask targeted questions, agree contract terms and keep monitoring.
How CyberRank helps: steps 3, 4 and 7 are automated; steps 1, 2, 5 and 6 stay with your privacy, procurement and legal teams. Nightly reassessment is the case for continuous monitoring over a one-off review.
- Classify the data. List the personal data categories the vendor will process, including specific (sensitive) data under UU PDP or special category data under GDPR. Your team owns this step.
- Set your acceptance rules. Decide which hosting countries and governing jurisdictions you accept, and which certifications you expect for each impact tier. Record them once and apply them to every vendor.
- Run an outside-in assessment. Check the vendor's published policy, consent practices, legal terms, hosting and breach history. CyberRank automates this step from the vendor's web address in minutes.
- Compare findings with your rules. Flag mismatches, such as hosting outside your approved countries or a missing breach-notification clause. CyberRank compares residency and jurisdiction with the lists you set.
- Ask targeted questions. Use a questionnaire to close the gaps public evidence cannot cover, such as internal access controls or retention practice. Questions based on actual findings get better answers than generic templates.
- Agree contract terms. Turn the remaining risks into processor agreement clauses: sub-processor approval, breach notice timelines, audit rights and transfer safeguards. Legal review owns this step.
- Monitor during the contract. Re-check the policy, hosting and breach history on a schedule that matches the vendor's impact tier. CyberRank reassesses monitored vendors nightly and alerts you to privacy-policy changes and new breaches.
How CyberRank helps with vendor privacy risk
CyberRank assesses any organisation from its web address, without questionnaires, agents or access to its systems, and every assessment includes a Privacy sub-rating beside the Security sub-rating, combined into an IISRI® rating from AAA to D.
Privacy findings feed the same risk model as security findings. You assign each vendor an impact tier from T1 (critical) to T4 (low), and CyberRank combines it with the vendor's likelihood of an adverse event on a risk heat map. Monitored vendors are reassessed nightly, and changes to a vendor's privacy policy raise an event.
Vendors can see their own findings, upload certificates such as ISO/IEC 27701, and request re-evaluation through a self-service portal. The full product view is on the cybersecurity and privacy rating page, and after registration you get a free assessment of your own organisation; the free security rating tool needs no registration.
- Privacy policy and consent: the policy is split into 15+ areas, cookie consent is checked, and GDPR and UU PDP indicators are assessed. Each issue comes with a plain-language explanation and a suggested rewrite.
- Legal terms: customer-facing terms are read for data protection and breach notification clauses.
- Data residency: public hosts are geolocated and compared with your preferred countries.
- Data sovereignty: the governing law and courts in a supplier's terms are identified and compared with the jurisdictions you accept.
Where CyberRank does not help
CyberRank assesses what a supplier publishes and exposes. It cannot see how staff actually handle data inside the vendor, whether retention schedules are followed, or what your signed contract says. It does not decide whether a processing activity is lawful, and it does not perform a DPIA for you.
A Privacy sub-rating is evidence of posture, not proof of compliance with GDPR or UU PDP. Close these gaps with targeted questionnaires, processor agreements, audits and legal review; for your own organisation's UU PDP readiness, see the guide to data privacy compliance audits.
Conclusion
A vendor privacy risk assessment answers a question security reviews usually skip: will this supplier handle personal data the way your obligations require? GDPR Article 28 and UU PDP Article 51 put that choice on you, and the evidence needs to stay current for the life of the contract.
Set acceptance rules for hosting and jurisdiction, assess every supplier against them, and focus questionnaires on what public evidence cannot show. CyberRank gives you a privacy rating for every vendor, on the same scale as security, refreshed nightly for monitored suppliers.
About this article
All text in this article reflects CyberRank's own perspective and is provided for general information. It is not legal advice. Product capabilities are described as of 15 November 2026; features marked Beta may change.
References
- European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28 and 44–49 (27 April 2016)
- Republic of Indonesia, Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, Articles 51, 56 and 74 (17 October 2022)
- Hukumonline, Perbedaan Pengendali dan Prosesor Data Pribadi Menurut UU PDP (accessed 15 November 2026)
- Katadata, Komdigi: Perpres Lembaga Pengawas PDP Masuk Tahap Final (5 November 2026)
- Bisnis.com, UU dan PP Sudah Ada, Pengamat: Aturan PDP Belum Efektif Tanpa Lembaga (8 September 2026)
Quick answers
Short, direct answers to questions this article raises.
- Quick answerHow to Check a Vendor's Privacy PolicyWhat to look for in a supplier's privacy policy under UU PDP and GDPR, common gaps, and how CyberRank flags them from a web address.
- Quick answerData Residency vs Data Sovereignty for VendorsThe difference between data residency and data sovereignty, why both matter for vendors, and how CyberRank checks hosting and governing law.
Frequently asked questions
Rate your vendors' privacy posture
See a Privacy sub-rating next to the security rating for every supplier, from just a web address.
Rate your vendors' privacy posture