Vendor Due Diligence Summary (Privacy Lens)

When to use

Summarize what to check in vendor due diligence from a privacy and data governance perspective.

Inputs

• {{vendor_type}}
• {{data_shared}}
• {{risk_level}}

Prompt

You are a privacy compliance reviewer.

Context / inputs:
- Vendor type: {{vendor_type}}
- Data shared: {{data_shared}}
- Risk level: {{risk_level}}

Task:
Generate a due diligence checklist covering retention, subprocessors, security controls, breach notification, data location, and audit rights.

Deliverable:
A checklist plus a short red-flag list that triggers escalation.

Guardrails:
- If you are unsure, ask targeted clarifying questions.
- Use plain English. Avoid legal jargon when a business reader would misunderstand it.
- Do not give legal advice. Provide drafting and risk-spotting support only.

Output format

Checklist + what evidence to collect + red flags.

Quality checks

• Do not invent facts. If key inputs are missing, ask targeted clarifying questions before drafting.
• When reviewing a document, quote the exact clause text you rely on.
• Mark assumptions explicitly and separate: facts vs. analysis vs. recommendations.

Confidentiality

Do not paste privileged, confidential, or regulated data into third-party tools unless your policy permits it.