Supplier and Processor Due Diligence
UK GDPR requires Controllers to use Processors that provide sufficient contractual guarantees with UK data protection law. That obligation does not end at contract signature. It starts before you share any personal data with a supplier, and it continues after the relationship ends. Most organisations understand this in principle. In practice, the due diligence that sits behind it is often incomplete, inconsistent, or done after the procurement decision has already been made.
The consequence is not theoretical. If a supplier suffers a personal data breach, when a processor is found to be non-compliant, or when the ICO asks how you satisfied yourself that a supplier was adequate before you gave them access to personal data, the due diligence record is the document they ask for.
Clark & Company conducts structured, independent due diligence assessments on suppliers and processors, giving you a clear, documented view of whether a supplier meets the standard required before you share personal data with them.
Pricing
| Service | Published Price |
|---|---|
| Supplier/processor due diligence assessment | £600 + VAT per assessment |
When due diligence is required
The following are among the most common situations where a structured due diligence assessment is the right step.
New supplier onboarding. Before personal data is shared with a new supplier or processor for the first time, you need a documented assessment of their data protection posture. This is not optional under UK GDPR. It is the controller’s obligation.
Contract renewal or re-procurement. A supplier you have used for years may not meet the standard you would apply today. Renewal is the right point to reassess, particularly where the processing has expanded or the regulatory environment has changed since the original engagement.
Post-incident review. A supplier has experienced a data breach, a compliance failure, or a service disruption that raises questions about their data protection arrangements. A fresh assessment confirms whether the supplier still meets the standard required, or whether remediation or exit is appropriate.
Regulatory preparation. You are preparing for an ICO audit, a Cyber Assessment Framework review, or an internal governance audit, and your supplier due diligence records are incomplete or inconsistent. A structured programme of assessments brings the position up to a defensible standard.
High-risk or sensitive processing. When a DPIA is required or the supplier will process special category data, children’s data, large volumes of personal data, or data that carries specific regulatory sensitivity. The due diligence threshold is higher and the assessment needs to reflect that.
What is Included
Every due diligence assessment with Clark & Company includes the following as standard.
Structured assessment. A consistent, repeatable assessment framework applied to every supplier, covering data protection governance, technical and organisational measures, sub-processing arrangements, international transfers, breach management, and data subject rights handling.
Supplier engagement. Clark & Company engages directly with the supplier on your behalf where required, requesting the information needed and following up where responses are incomplete or inadequate. You do not need to chase your own suppliers through the process.
Evidence review. Assessment is based on evidence, not self-certification alone. Where a supplier provides policies, certifications, audit reports, or technical documentation, we review them against the claims made and flag where the evidence does not support the position.
Risk rating. Each assessment concludes with a clear risk rating: acceptable, acceptable with conditions, or not acceptable in current state. Where conditions are attached, they are specific and actionable. Where the supplier is not acceptable, we tell you plainly.
Written report. A structured due diligence report is provided for each assessment, recording the scope, the evidence reviewed, the findings, and the risk rating. This is the document you file as your due diligence record and the one you produce when asked how you satisfied yourself that the supplier was adequate.
Remediation guidance. Where a supplier falls short, the report includes specific guidance on what needs to change before the risk rating can be revised. This gives you and the supplier a clear path forward rather than a pass/fail with no explanation.
Senior practitioner throughout. Assessments are conducted by a senior practitioner with direct experience in education and public sector supply chains. The judgment applied reflects the sector context, not a generic compliance checklist.
Frequently Asked Questions
How long does an assessment take?
Most individual assessments are completed within three to five working days, depending on the responsiveness of the supplier. Where you have a batch of suppliers to assess, we will agree a programme timeline at the outset.
Can you assess suppliers we are already using?
Yes. Many organisations have suppliers that were onboarded before their current due diligence framework was in place. Retrospective assessment brings the record up to a defensible standard and identifies any gaps that need addressing.
What if a supplier refuses to cooperate?
It happens. Where a supplier is unwilling to provide the information needed for a meaningful assessment, that is itself a finding. We will record it, advise you on the risk position, and help you decide whether to escalate, remediate, or exit.
Can you run a programme across all our suppliers?
Yes. Where you need to assess a large number of suppliers, we scope a programme with prioritisation based on risk, volume of personal data processed, and contract renewal dates. Block pricing is available on enquiry for programmes of ten or more assessments.
Is this the same as a cyber security assessment?
No. This is a data protection due diligence assessment. It covers the supplier’s data protection governance, not their full cyber security posture. Where cyber security assessment is also required, Clark & Company offers this as a separate service under the Cyber Security pillar.