Privacy Questions in Security Reviews: What Buyers Ask and the Evidence to Attach

Short answer: Privacy questions in security reviews test whether you know what personal data you hold, what role you play, who else touches it, where it goes, how long you keep it and how fast you report problems. Answer each one with a short statement plus a document: a records of processing, subprocessor list, DPA, retention schedule, DSAR procedure and transfer mechanism.

Related guides:

• How to respond to enterprise security questionnaires fast
• Enterprise security review
• Data processing agreement

Key takeaways

• The privacy section is a separate test. A SOC 2 report covers your controls, but buyers still want to know what data you process, for whom and under which contract.
• Start with your role. Most B2B SaaS vendors act as a processor (or service provider) for customer data and as a controller for their own account and marketing data. Say which applies to which data.
• Every answer needs an artifact. A yes without a document behind it usually triggers a follow-up round.
• Subprocessors, transfers and AI training generate many of the follow-ups, in our experience.
• HealthTech adds a HIPAA layer. If you touch PHI, expect BAA, breach notice and subcontractor questions on top of GDPR-style ones.

---

Which privacy questions show up in security reviews?

Most privacy sections cluster into the eleven themes below, and each one has a real concern underneath the wording.

Use this table as your map. For the security side of the same questionnaire, see our guide to important security questionnaire questions with examples.

Category	What they are really asking	Evidence to attach
Data inventory	Do you know exactly which personal data you hold about our users?	Records of processing (RoPA), data flow diagram
Role	Are you our processor, or do you also use our data for your own purposes?	DPA, privacy notice section on customer data
Lawful basis	For data you control, can you justify the processing?	RoPA column for lawful basis
Subprocessors	Who else touches our data, and will you tell us before that changes?	Subprocessor list, change notice process
Residency and transfers	Where is our data stored and accessed, and what legal mechanism covers transfers?	Hosting regions, SCCs or framework certification
Retention and deletion	How long do you keep our data, and can you prove deletion at exit?	Retention schedule, deletion procedure
Data subject requests	Can you help us answer access and erasure requests on time?	DSAR procedure, product export and delete features
DPA	Will you sign our terms, or do you have your own?	Your DPA template
Breach notification	How quickly will you tell us about an incident?	Incident response plan, DPA notice clause
AI and model training	Is our data used to train models, yours or a vendor's?	AI data use statement, AI vendor terms
PHI and BAAs	Will you sign a BAA and handle PHI under HIPAA?	BAA template, HIPAA risk analysis summary

How do you answer data inventory and controller or processor questions?

Answer from your records of processing, and state your role per data category rather than for the company as a whole.

GDPR Article 30 requires controllers and processors to keep records of processing activities, and the EDPB's controller or processor guide for SMEs lists keeping records of processing operations among processor duties. It is your best source for inventory questions.

The EDPB guide explains that a controller "determines the purposes and means of processing personal data," while a processor acts on the controller's instructions only. A typical SaaS answer looks like this:

1. Customer content and end-user data: we act as a processor and process it only on the customer's documented instructions under our DPA.
2. Account, billing and support contact data: we act as a controller under our privacy notice.

Lawful basis questions under GDPR Article 6 apply to the data you control. For processor data, say the customer as controller determines the lawful basis. If a buyer asks about high-risk processing, attach a summary of your privacy impact assessment.

What do buyers ask about subprocessors, residency and transfers?

They want a current subprocessor list, advance notice of changes, and a named legal mechanism for any data leaving the EU or EEA.

Subprocessors. Under GDPR Article 28, as the EDPB summarizes, a processor "shall not engage another data processor without prior specific or general written authorisation" of the controller, and must bind each subprocessor to the same data protection obligations. Your answer should include:

• a public or shareable subprocessor list with each vendor's purpose, data categories and location
• how customers are notified of a new subprocessor and how they can object
• confirmation that each subprocessor has signed equivalent data protection terms

Residency. Name your hosting regions and where staff can access data from. "Stored in the EU" is incomplete if engineers elsewhere have production access.

Transfers. GDPR Chapter V (Articles 44 to 49) restricts transfers outside the EEA. The two mechanisms buyers ask about most:

Mechanism	What it is	What to attach
Adequacy for the US	The Commission's adequacy list covers US commercial organisations participating in the EU-US Data Privacy Framework	Your certification status, or each US subprocessor's
Standard contractual clauses	Model clauses pre-approved by the European Commission, modernised in June 2021	The SCC module referenced in your DPA

As of October 2026, the Commission's EU-US data transfers page notes that US safeguards also support transfers made under SCCs and binding corporate rules. Many vendors list both mechanisms so the buyer's counsel can choose.

How do you answer retention, DSAR and breach notice questions?

Give a concrete retention period, a documented process for helping customers with requests, and a breach notice commitment that matches your DPA word for word.

Retention and deletion. Publish a retention schedule by data category and state what happens at contract end. The EDPB's processor guide lists deleting or returning data at the controller's choice after services end as a required contract term. Buyers often ask how long deleted data survives in backups, so say.

Data subject requests. Controllers must respond within one month, and the EDPB's individual rights guide says they "may extend the time limit by two further months" for complex requests if they inform the person within the first month. As a processor, your job is to help the customer meet that clock. Describe the self-service export and delete features, plus how fast your team handles escalated requests. For background on each right, see our GDPR data subject rights guide.

Breach notification. The EDPB's data breach guide explains that a controller must notify the supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to pose a risk to individuals, and that a processor must alert the controller "without undue delay." Because the processor duty has no fixed hour count, many buyers ask you to commit to one in the DPA. Whatever you commit to, the incident response plan you attach must show the same number.

How do you answer questions about AI and model training?

State plainly whether customer data is used to train or improve any model, and back it with your AI vendor terms and settings.

In our experience these questions are now a common addition to privacy sections. Buyers usually want four answers:

1. Training: is customer data used to train your own models, and is it opt-in or opt-out?
2. Third-party AI providers: which ones process customer data, are they on your subprocessor list, and do their terms allow them to train on it?
3. Retention by the AI provider: how long are prompts and outputs kept?
4. Controls: can the customer turn AI features off for their tenant?

Attach a one-page AI data use statement and make sure every AI provider appears on your subprocessor list.

Which HIPAA and BAA privacy questions do HealthTech vendors get?

If you create, receive, maintain or transmit PHI for a covered entity, you are a business associate, and buyers will ask whether you sign BAAs and how you report breaches.

HHS's cloud computing guidance is clear that business associate status applies "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." Expect these questions:

Question	What they are really asking	Evidence to attach
Will you sign our BAA?	Are you ready to accept HIPAA obligations in writing?	Your BAA template, redlines you accept
How fast will you report a breach?	Will your notice reach us in time for our own obligations?	Incident plan, BAA notice clause
Which subcontractors touch PHI?	Is every downstream vendor bound by a BAA?	PHI subcontractor list with BAA status
What happens to PHI at termination?	Will you return or destroy it?	Deletion procedure, BAA termination clause

Under 45 CFR 164.410, a business associate must notify the covered entity of a breach of unsecured PHI "without unreasonable delay" and "in no case later than 60 calendar days after discovery." Many health systems ask for a shorter contractual window. HHS's sample business associate provisions also require subcontractors to "agree to the same restrictions and conditions that apply to the business associate," and require return or destruction of PHI at termination where feasible.

What belongs in a privacy evidence pack?

A privacy evidence pack is a short, versioned set of documents that answers most privacy questions before they are asked.

Keep each item current, with a named owner:

• Records of processing (RoPA) with data categories, purposes, recipients and transfers
• Data flow diagram showing where personal data enters, is stored and leaves
• Subprocessor list with purpose, data categories, location and change notice process
• DPA template with the processor terms buyers expect
• Transfer mechanism such as SCCs or Data Privacy Framework certification
• Retention schedule by data category, including backups
• DSAR procedure covering how you support customer requests
• Incident response plan with breach notification steps that match your DPA and BAA
• AI data use statement covering training, providers and retention
• BAA template and PHI subcontractor list (HealthTech only)

What slows privacy reviews down, and how do you keep answers consistent?

Inconsistency is the biggest red flag, because it tells the reviewer your documents do not describe reality, so route every question through one flow.

1. Question received: log it with the deal and the buyer's deadline.
2. Classify: tag it to one of the categories above.
3. Pull evidence: reuse the approved answer and attach the matching document.
4. Legal or privacy review: for anything that changes contract terms, such as notice windows.
5. Answer and save: store the final wording so the next questionnaire reuses it.

In our experience, these patterns trigger the longest follow-up rounds:

• Role confusion: calling yourself a processor while your privacy notice says you use customer data for product analytics.
• A stale subprocessor list that omits an AI provider or support tool.
• Mismatched timelines: the DPA promises one breach notice window, the incident plan says another.
• Vague retention: "as long as necessary" with no periods and no answer for backups.
• No transfer mechanism named for a US-hosted product selling into the EU.
• "N/A" on HIPAA questions when your product clearly stores clinical data.

How SecureSlate helps

SecureSlate keeps the documents behind privacy answers connected to your controls. GDPR, HIPAA, SOC 2 and ISO 27001 are built-in frameworks with multi-framework control mapping, so evidence collected once supports several reviews. US state privacy laws such as CCPA can be set up as a custom framework with your own controls. Vendor risk management tracks your subprocessors and their agreements, security questionnaire automation drafts answers from your approved library, and the trust center lets buyers find your subprocessor list, policies and reports without a back-and-forth. Start a free trial.

FAQ

Is a SOC 2 report enough to answer privacy questions?

Usually not. A SOC 2 report focuses on security controls, and many reports do not include the Privacy criteria. Buyers still ask about your role, subprocessors, transfers, retention and DPA terms, which need their own documents.

Should we answer as a controller or a processor?

Answer per data category: usually processor for customer content you handle on instructions, controller for your own account, billing and marketing data.

What is the most important document for the privacy section of a security questionnaire?

Your records of processing, because the subprocessor list, retention schedule, transfer answers and data flow diagram all derive from it.

Do we need a BAA if we only store encrypted PHI?

Per HHS cloud computing guidance, yes. A service that maintains encrypted ePHI for a covered entity is a business associate even without the decryption key.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.