New suppliers: which checks to keep separate in the file

Draft date: 8 November 2026. Author: Redazione X20 Digital Trust.

When assessing a new supplier, keep questions about identity, reliability, the contract and data processing separate, then connect the findings to the decision. An adverse news report does not replace checking who signs; a privacy clause does not demonstrate technical suitability. The file should show which question has been answered and which remains open.

This guide proposes an organisational method for businesses and professionals. It does not define a package sufficient for every sector or assign requirements for regulated services to every supplier. Start with the service actually being purchased and its impact on the business's activity.

Identify the relationship before collecting documents

Describe what the supplier will do and who will use the service. An occasional engagement with limited access may require a different assessment from an ongoing service managing essential information. Write down the data and processes involved. A concrete description avoids lengthy questionnaires disconnected from the actual risk.

Identify the contracting counterparty, which may differ from the trading brand. Check the connection between the proposal, conditions and invoicing entity. If an intermediary presents another operator's service, clarify their respective roles before attributing every execution responsibility solely to the commercial company. Keep the explanation available to those reviewing the agreement so different teams do not assess different entities under the same brand name.

Give counterparty sources their own section

Collect information relevant to identification and the powers of those acting. If public news is examined, retain its source and date and check for namesakes. A search without results must preserve its scope: it does not certify an absence of concerns or amount to checking every possible list or registration.

Assess relevance separately. An event concerning a former executive is not automatically attributable to the company; historical matters may require updates. If a source is inaccessible, state the limitation rather than presenting a search engine snippet as fully reviewed text. The conclusion should be no broader than the evidence actually examined.

Review the contract against the service

Compare the commercial description with the contractual scope. Identify deliverables, dependencies and excluded activities. Check how changes are handled and who may approve them. An operational message may contain a request without necessarily explaining the change's costs and conditions.

Retain the version submitted for decision and the version actually agreed. Attachments must be recognisable and consistent with the text. If a clause refers to a changeable webpage, consider how to document relevant content at the time of agreement. Do not give an internal copy universal evidential status: its purpose is to keep the file understandable.

Assess data processing roles

If personal data is involved, identify the activities and assess actual roles. A supplier is not automatically a processor simply because it is external. Classification requires examination of decisions about purposes and means, with the documentation necessary for the circumstances.

Check access, the people involved and any use of other operators. Information obtained should match the service being activated. If the file contains representatives' personal information, limit collection and access to what the purpose requires. Due diligence does not authorise indiscriminate storage of private information. A useful file contains pertinent evidence rather than every document that happened to be available online.

An entirely fictional example

The imaginary company “Pietra Progetti” assesses a cloud service. The salesperson sends a favourable profile of the supplier and standard conditions. The assigned reviewer discovers that the contract concerns a different entity and the service allows another operator, absent from the profile, to access documents.

The decision remains incomplete under the internal procedure. The contracting entity and data flow are clarified without treating the reputation report as answering both questions. This invented case does not suggest every difference requires rejection: it shows which checks should not be merged. Each finding must be connected with the question it can actually answer.

Assign open issues to people able to resolve them

A list of concerns without owners tends to stall. For each issue, specify the document or clarification required and the competent function. Legal, technical and operational questions may share material but require different expertise. Coordination prevents inconsistent decisions rather than turning a single reviewer into an expert on everything.

In the final decision, clarify approved conditions and matters requiring follow-up, within applicable rules. Do not label a file “approved” where a mandatory check is missing. If the service changes, revisit affected parts rather than relying indefinitely on the initial assessment. Retain the reason for the review so a later owner understands which change triggered it.

Sources and limitations

The EDPB guide to privacy roles helps distinguish controllers from processors. The GDPR remains the legislative source. For businesses within its scope, DORA establishes a specific ICT risk framework: this guide does not extend it to every software purchase.

To compare tools addressing counterparties, contracts and evidence of obligations, you can view the X20 Digital Trust apps.