A customer sent us a GDPR questionnaire about our data protection – how do we fill it in?

When your company processes data on a customer's behalf – you provide IT, accounting, call-centre, logistics or software services – you are the processor and the customer is the controller. The controller is responsible for the supplier it chooses. That is why banks, insurers, healthcare providers and international groups often send long questionnaires before signing.

A questionnaire is not law. Your answers become promises that may be written into the contract. So the most important rule: write what you do, not what you would like to do.

Two fields where it is easy to get it wrong

Subprocessors. These are everyone who will process the customer's data on your side: cloud hosting, email system, customer-support platform, backup service. Article 28(2) GDPR forbids engaging another processor without the customer's prior specific or general written authorisation; with a general authorisation, you must tell the customer about changes in advance. If you give an incomplete list and it later turns out the data passes through one more company, that breaches both the contract and Article 28(2).

Processor record. It differs from your record as a controller. Article 30(2) GDPR requires a processor to keep a separate record: on whose behalf you process, what categories of processing you carry out, whether you transfer outside the EU, and what security measures apply. For a company with fewer than 250 employees the duty falls away only if the processing is occasional, is not likely to result in a risk, and does not include special-category data or data on criminal convictions (Article 30(5)) – processing a customer's data as a service is almost never occasional.

1. Read the whole questionnaire before you start. Mark the questions whose answer is in a document, and those for which no document exists.
2. Collect the five documents listed in the short answer. If one is missing, that is your first task, not the questionnaire.
3. Answer briefly and verifiably. "Data is encrypted" is a weak answer. "The database is encrypted with AES-256; access only via VPN with two-factor authentication" is verifiable.
4. Answer "no" honestly and add a date. "No training at present; the first session is planned for 2026-11" is better than a "yes" you cannot prove.
5. Attach documents when asked, but not your internal password policy or network diagrams. A description is enough there.
6. Keep a copy of your answers. When the same customer sends an updated questionnaire a year later, you have a starting point. When another customer sends one, you already have most of the answers.

• Unlimited liability for any data breach. That is a commercial term, not a GDPR requirement.
• Breach notification within 1 hour, if your process cannot deliver it. Article 33(2) GDPR says "without undue delay"; a contract may set a number of hours – choose one you will actually meet. Do not promise 72 hours either: that is how long the customer has to notify VDAI (Article 33(1)), so it needs your information sooner.
• Unlimited audits at your premises. Article 28(3)(h) GDPR obliges you to allow for and contribute to audits, including inspections, so you cannot rule them out entirely; frequency, notice and costs can be agreed.
• Certificates you do not have. ISO 27001 or any other certificate is not mandatory under the GDPR; if you do not have one, say so.

The customer's data processing agreement may arrive with the questionnaire. Read it together with your answers: if you wrote 48 hours for breach notification in the questionnaire and the agreement says 24 hours, the signed agreement will usually apply.

If the questionnaire showed missing documents, start with the record and the data processing agreement. With the tool (in Lithuanian) you can find out free of charge, in a few questions, whether you must keep a record of processing activities. Fixed-price one-off procedures: data processing agreement – €49 excl. VAT; record of processing activities – €95 excl. VAT. We prepare record templates by sector: apartment building management, online shop, company (general), IT company, museum, dental clinic, outpatient clinic, restaurant, municipal administration, social care home, sports club, transport company, pharmacy.

Do we have to answer the questionnaire?
The law does not oblige you to. But the customer must satisfy itself that the supplier is reliable (Article 28(1) GDPR), so without answers there will probably be no contract.

Can we give every customer the same set of answers?
Yes, if it is true and up to date. The questions differ, but the answers draw on the same documents.

What if we do not know whether we are a processor?
Settle the role first: if you yourself decide what the data is used for and how, you are a controller, and the questionnaire may not fit.

Do we have to list every employee with access?
Usually roles and head count are enough. A list of names is not needed unless requested for a specific reason.

• Do we need a data processing agreement with an IT provider? (in Lithuanian)
• Do we need SCCs when a supplier is outside the EU? (in Lithuanian)
• Technical and organisational security measures: a description for a small company
• Staff GDPR training: how to run and document it

The law and the risk: GDPR audit, compliance documents and advice – dat.lt

• The controller uses only reliable processors – Article 28(1) GDPR.
• Subprocessors only with written authorisation – Article 28(2) GDPR; the same terms for the subprocessor – Article 28(4).
• Mandatory contract content – Article 28(3) GDPR; confidentiality – Article 28(3)(b); audits – Article 28(3)(h).
• Processor record – Article 30(2) GDPR; the exemption for companies under 250 employees and its limits – Article 30(5).
• Security measures – Article 32(1) GDPR; certification as evidence – Article 32(3); staff act only on instructions – Article 32(4).
• Processor notifies the controller of a breach – Article 33(2) GDPR.
• Transfers outside the EU – Articles 44 and 46 GDPR.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). This text is general information and is not individual legal advice.