1. What this is for

Use this checklist before appointing or renewing a vendor that will handle personal data for Quillmarrow. It helps the responsible owner understand what the vendor does, where information goes, what controls are described and what evidence remains outstanding.

A data intermediary processing personal data on Quillmarrow’s behalf has protection, retention and breach-notice duties. Quillmarrow remains responsible for the personal data and should not assume that appointing a vendor transfers all of its responsibilities. The DPO should confirm how the duties apply to each arrangement with a Singapore-qualified lawyer.

The checklist supports review of G-07, G-08, G-09 and G-10. Use it alongside the B3 data inventory, B8 retention schedule and B11 breach management plan. It is not, by itself, evidence that a vendor’s controls are operating or that an overseas transfer has appropriate safeguards.

2. How to use it

The business owner proposes the review, with the IT Manager coordinating technical questions and the Head of Operations, Quillmarrow’s appointed DPO, overseeing personal data and transfer questions. Send the checklist before a new appointment or renewal, and repeat the review when the service, access, processing location or risk changes materially.

Before sending it, use B3 to describe the service and the relevant personal data. Ask the vendor to identify any subcontractors and locations involved, and to provide supporting documents appropriate to the service. Do not send customer databases or unnecessary personal data as part of the review.

For each answer, record:

• The question ID, response and date received.
• The person or role reviewing it and the relevant service or system.
• The supporting evidence, its location and date, or “Not provided”.
• The gap, proposed action, owner and target date.

Distinguish a vendor’s statement from evidence that has been reviewed. A blank answer or unavailable document stays visible as missing; do not infer that a control exists. Record unresolved actions in B2 and refer material contract or legal questions to a Singapore-qualified lawyer.

The three records below are completed as review records, not as proof that all questions were answered or supporting documents received. Other vendors named in B3, including Fictional PayGate, Fictional MailBurst, Fictional PeopleDesk, Fictional Helpdesk and Fictional LedgerOne, remain in scope for the checklist but are not completed in this sample.

3. Summary of DV-01 to DV-03

These dates are proposed targets. The DPO should review outstanding answers and evidence with each owner and escalate unresolved risks to the COO. A questionnaire response alone does not close an action.

4. Contract points to raise with your lawyer

The following are discussion points for a Singapore-qualified lawyer, not legal drafting. The contract should reflect the actual service, data and locations rather than relying on a generic clause.

1. Purpose and instructions. Define the service, the personal data involved and the permitted purposes. Address how Quillmarrow gives instructions and how the vendor handles requests to use data for another purpose.

2. Security measures. Specify proportionate technical and organisational measures, including access controls, administrator privileges, authentication, logging and secure transmission where relevant. Agree how material changes are communicated.

3. Breach notice to Quillmarrow. A data intermediary processing on Quillmarrow's behalf must notify Quillmarrow without undue delay after it has credible grounds to believe a breach occurred. Agree the contact route, information to provide and how updates will be supplied.

4. Breach response cooperation. Require practical assistance with containment, investigation, preservation of relevant evidence and follow-up. Coordinate these arrangements with B11; notification to Quillmarrow is separate from Quillmarrow’s own assessment and notification decision.

5. Sub-processors. Define whether the vendor may appoint another processor, what approval or notice is needed, and how equivalent obligations and oversight will be arranged.

6. Locations and transfers. Identify where data is accessed, stored and processed, and how changes will be notified. For overseas transfers, ask the lawyer to assess appropriate safeguards; the ASEAN Model Contractual Clauses may be one option.

7. Retention and end of service. Agree retention instructions consistent with confirmed B8 decisions, the return or secure deletion of information at the end of service, treatment of backups, permitted exceptions and evidence of completion.

8. Audit and evidence rights. Agree what assurance documents, audit access or independent reports Quillmarrow may request, how often they will be reviewed and how identified gaps will be addressed.

9. Staff confidentiality and access. Address confidentiality commitments, access limited to authorised personnel, prompt removal of unnecessary access and the vendor’s responsibility for its personnel.

10. Access and correction assistance. Set out how the vendor will forward requests and assist Quillmarrow to locate, provide or correct information in time for the B7 process. Clarify responsibilities where a request is received directly by the vendor.

11. Changes, termination and unresolved issues. Agree how changes to the service or risk are reviewed, how Quillmarrow can raise and track concerns, and what happens to access and data when the arrangement ends.

5. Decision after the review

The checklist ends in a decision, recorded by the DPO and approved by the COO. The three options are: continue (answers and evidence are adequate), continue with conditions (named actions and a date, tracked in B2), or stop or replace (the risk cannot be brought to an acceptable level).

The decision, the evidence relied on and any open conditions are recorded against the vendor in B2 (G-07 or G-09). A vendor that has not answered by the due date is escalated to the COO, not quietly carried forward.

The 18-question vendor checklist follows.

Evidence summary

Role and data

Security and access

Breach and incidents

Retention and return

Sub-processors and location

Contract