Security questionnaire answers › Privacy
Are you GDPR compliant? How to answer it in a security questionnaire
Why buyers ask this
Any company serving EU residents' data needs to show it respects data subject rights and lawful processing.
What a strong answer includes
- Avoid a flat 'yes'. Describe the concrete measures: DPA, records of processing, rights-request process, breach process, DPO or privacy lead.
- Say your role (controller or processor) for the product.
- Name transfer mechanisms.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
We process customer personal data as a [processor] under a data processing agreement. We maintain records of processing, support data subject requests within [30 days], have a breach notification process, and rely on [SCCs] for international transfers. Our privacy contact is [email].
Evidence to attach
- DPA
- Records of processing
- Privacy policy
- Rights-request procedure
Common mistakes
- Claiming 'GDPR certified'. There is no GDPR certification of that kind.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.