# Vendor DPA & AI Subprocessor 10-Point Audit Checklist
**Organisation**: [Your Company Name]  
**Vendor Being Evaluated**: [Vendor / SaaS Name, e.g., OpenAI / Mistral / AWS]  
**Date of Assessment**: [Date]  
*Statutory Reference: GDPR Article 28(3) & EU AI Act Article 25 Subprocessor Governance.*

---

## The 10 Mandatory Verification Points

### 1. Documented Instructions Only (GDPR Art. 28(3)(a))
- [ ] Vendor contract explicitly states the processor acts *only* on documented instructions from the controller.
- [ ] Vendor agrees not to use controller data for secondary commercial purposes without consent.

### 2. Zero AI Model Training Guarantee (AI Safeguard)
- [ ] Contractual guarantee that customer prompts, inputs, and outputs are **not** used to train the vendor's foundation models.
- [ ] Zero Data Retention (ZDR) policy enabled or 30-day ephemeral caching agreement in place.

### 3. Confidentiality Commitments (GDPR Art. 28(3)(b))
- [ ] Vendor warrants that all personnel authorized to process personal data have committed to confidentiality.

### 4. Technical and Organisational Security Measures (GDPR Art. 28(3)(c) & Art. 32)
- [ ] Vendor provides third-party certification (e.g., ISO/IEC 27001, SOC 2 Type II).
- [ ] Encryption in transit (TLS 1.3) and encryption at rest (AES-256).

### 5. Subprocessor Prior Authorization (GDPR Art. 28(3)(d))
- [ ] Vendor requires prior written notice (minimum 30 days) before adding or replacing sub-processors.
- [ ] Controller retains the legal right to object to new sub-processors.

### 6. Data Subject Rights Assistance (GDPR Art. 28(3)(e))
- [ ] Vendor provides technical mechanisms or SLAs to fulfill erasure (right to be forgotten) and access requests within 14 days.

### 7. Security Incident & Breach Notification SLA (GDPR Art. 28(3)(f) & Art. 33)
- [ ] Vendor is legally bound to notify the controller of any confirmed personal data breach without undue delay (maximum 24–48 hours).

### 8. End-of-Contract Data Deletion or Return (GDPR Art. 28(3)(g))
- [ ] At the end of provision of services, vendor is obligated to delete or return all personal data and certify deletion.

### 9. Right to Audit and Inspect (GDPR Art. 28(3)(h))
- [ ] Vendor makes available to the controller all information necessary to demonstrate compliance and allows for audits.

### 10. International Data Transfer Safeguards (GDPR Chapter V)
- [ ] If data is hosted outside the EEA: Vendor is certified under the EU-U.S. Data Privacy Framework (DPF) or has executed Standard Contractual Clauses (SCCs 2021/914).
- [ ] Transfer Impact Assessment (TIA) completed assessing US CLOUD Act exposure.

---

**Evaluator Name**: ___________________________  
**Approval Status**: [ ] Approved  [ ] Conditional Approval  [ ] Rejected  
**Sign-off Date**: ___________________________