What to include in a GDPR Supplier Questionnaire

Since its inception last year most organisations have adapted their processes to meet the data protection regulations set out by GDPR on 25th May 2018.

However, following the barrage of emails received by members of the team on Black Friday and Cyber Monday, this got us thinking about GDPR again. 

Now, if you want to know why you received countless emails from retailers trying to encourage you to use their 20% off codes or enticing you into buying a new hoover to obtain a ‘free car cleaning kit’, then this isn’t the blog for you, and we don’t have those answers. All we can say on that matter is, return periods are slightly longer this time of year, so if you’re sitting wondering why you decided to add 500HD channels to your TV package you should have some more time to reconsider!

If however, you are looking for what to include on a GDPR Supplier Questionnaire or a free template to base your questionnaire on, you’ve come to the right place.

So what should you be asking your current and prospective suppliers in regards to GDPR? And can you use your current eSourcing process to eliminate any future GDPR headaches? 

Below we have put together a basic template of a GDPR Supplier Questionaire that could be sent out to all new suppliers before going to tender. 

After all, GDPR was brought in to protect the data of organisations, as well as stopping unsolicited sales emails and ‘Black Friday’ offers!

GDPR Supplier Questionnaire template

1. Please identify your nominated Data Protection Officer (DPO) and their responsibilities.
2. Please identify your nominated Data Compliance Officer (DCO) and their responsibilities. (This could also be known as your organisations ‘Data Controller’)
3. Please explain the data privacy and security training received by employees in your organisation. As well as the schedule this is kept to.
4. What tools and practices are being utilised in your organisation to manage the identification, tracking, and destruction of personal data associated with an individual?
5. Describe your organisation’s schedule/process for reviewing and updating internal policies for processing data.
6. Where does your organisation store personal information managed on our/the client’s behalf? 
7. If you choose to store information with a third-party processor, please identify them and where the data is stored.
8. Do contracts used by your organisation clearly detail what happens to data at the end of the agreed contract period?
9. What process and methods does your organisation use for information sanitization? Such as anonymising and encrypting personal data?
10. Please describe the process for detecting and communicating data breaches within your organisation.

(For Clarity on the roles of DPO and DCO, the following article highlights the responsibilities of both positions.)

How to use Market Dojo to run your Supplier Questionnaires

Whether you’re already a user of Market Dojo or are looking for a solution that can efficiently send questionnaires to suppliers as part of your tendering process. Market Dojo makes communicating with suppliers easy. Our cloud-based sourcing solution ensures you are able to access all your events and tenders regardless of where you, or your suppliers, are in the world.

Our on-demand functionality also means you can use our software as and when you need. So if your organisation only buys once, or a couple of times a year, you can use our software on a basis that suits you.

Sending your suppliers a questionnaire couldn’t be easier. Our eSourcing solution can be fully integrated with any existing Microsoft Excel sheets you use to tender, making importing and exporting supplier information effortless.

The following video outlines how to create questionnaires for your sourcing event in Market Dojo, including how to set up scoring and weighting with different question types.

Finally, if you are looking for advice on your own GDPR Statement, or wish to view Market Dojo’s, you can do so here.