Vendor security and GDPR questionnaire builder for universities
Describe the tool you are buying in seven short questions and get a vendor questionnaire that asks only what matters for it. Every question comes with the reason, the legal or standard reference, and the evidence to request. Copy it, download it as CSV or Markdown, or print it.
Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português
The short version
- The builder below turns seven intake questions into a vendor questionnaire picked from a bank of 90: about 20 questions for a simple tool, 35 to 50 for a typical service with student data or AI, and 70 or more for a high-risk platform.
- Questions are grouped into ten domains: company and contract, GDPR and the DPA, subprocessors, transfers, security, AI and the EU AI Act, accessibility, data lifecycle, integration, and supply chain and NIS2.
- Each question shows why it is asked, the legal or standard reference (for example GDPR Art. 28(3)(d)) and the evidence to request.
- A risk tier (light, standard or full) sets the depth, so a low-risk tool gets a short questionnaire and a high-risk one gets the full set.
- Export to CSV for Excel, Markdown or print. Everything runs in your browser.
Runs entirely in your browser. Nothing you type or tick is stored or sent anywhere.
Collecting answers is the easy part. In Validemic the vendor gets one link, answers and uploads evidence, and you get a report where every finding is cited against GDPR, the EU AI Act and your own policies.
Contents
What is a vendor security questionnaire?
A vendor security questionnaire is a structured set of questions a university sends to a supplier before buying or renewing a service. It asks how the supplier protects data, which laws it meets and which documents prove it. Used well, it is an index to evidence: each answer points to a contract clause, certificate, report or list you can check.
In a European university the questionnaire serves several people at once. The data protection officer needs the processor terms, subprocessors and transfers under the GDPR. IT security needs certificates, encryption, access control and incident handling. Procurement needs contract, liability and exit terms, and increasingly someone needs to check AI features against the EU AI Act and accessibility against EN 301 549. Our vendor assessment guide for universities describes the whole process; the questionnaire is one step in it.
Why tailor the questionnaire?
Because long, generic questionnaires produce poor answers. Vendors that sell to many universities receive hundreds of questionnaires a year. When a 300-line spreadsheet arrives for a simple tool with no personal data, the answers are often copied from a previous response, and the questions that matter are lost among the ones that do not.
Tailoring helps both sides:
- The vendor answers fewer questions, and each one clearly applies, so the answers are more specific.
- The reviewer reads fewer answers and can spend the time on the documents behind them.
- The decision is easier to defend, because the depth of the review matches the risk.
Risk-based scoping is also how sector questionnaires work now. EDUCAUSE says HECVAT 4 starts with scoping questions that decide which questions apply (see our HECVAT guide for European universities). Several universities scale their process by value or data, as the examples below show.
How the builder chooses questions
The builder gives the tool a score from your intake answers. Personal data, special category data, data about minors, generative AI, unknown or non-EEA hosting, broad integrations, NIS2 scope and a high contract value each add to it. The score sets a tier, and every question in the bank has a minimum tier and, where relevant, a trigger.
| Tier | Typical tool | What it includes |
|---|---|---|
| Light | A low-value tool with little or no personal data, hosted in the EEA, no AI | Core contract, security and accessibility questions, plus the core GDPR items if there is any personal data |
| Standard | A service with staff or student data, SSO or an LMS integration, or AI features | Adds the remaining Article 28(3) points, access control, logging, vulnerability management, incident response and exit |
| Full | Special category data, minors, generative AI on student data, unknown hosting, or a high-value tender | Adds transfer impact assessments, secure development, staff security, AI governance and supply chain questions |
Triggers work independently of the tier. If you tick LTI, you get the LTI 1.3 and roster-data questions. If the tool uses generative AI, you get the training, model provider, prompt retention and Article 50 transparency questions. If hosting is outside the EEA or not known, the transfer questions move up to the light tier. Special category data and data about minors always produce a full questionnaire.
The result is a starting point. Delete questions that do not fit, and add your own institutional requirements, such as national security classification rules or library licence terms.
Is there a HECVAT alternative for Europe?
The HECVAT is still useful in Europe, but it does not replace the EU-specific questions. The HECVAT, maintained by EDUCAUSE with Internet2 and REN-ISAC, is a broad security, privacy and accessibility questionnaire that many vendors to higher education have already completed. European law needs specific documents: an Article 28 processor contract, a transfer tool for each non-EEA recipient, an AI Act classification and an EN 301 549 conformance report.
| Topic | HECVAT 4 | This builder |
|---|---|---|
| Scope | One file with scoping questions; a shorter "lite" view of critical questions | Tailored subset of a 90-question bank, chosen from seven intake answers |
| Legal anchor | Written for higher education generally, with US origins | GDPR, EU AI Act, NIS2, Data Act, Web Accessibility Directive, Cyber Resilience Act |
| Evidence | Answers in a spreadsheet, scored by the institution | Each question names the evidence to request |
| Licence | Free for colleges, universities and their vendors; owned by EDUCAUSE | Free; written from scratch, not derived from the HECVAT |
Validemic's analysis
If a vendor sends a recent HECVAT 4, accept it for the general security questions and send only the EU-specific domains from this builder: GDPR and the DPA, subprocessors, transfers, AI and accessibility. That avoids asking the vendor the same thing twice. For a Word version with 77 questions in 11 sections, see the European vendor questionnaire on our HECVAT page.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
How do you evaluate the answers?
Evaluate the evidence, not the answer text. A questionnaire answer is the vendor's statement; the decision should rest on the documents it points to. Read each answer next to its evidence, note gaps, and send one round of follow-up questions before you decide.
- Check that the answers match the plan you are buying. Privacy terms, AI training defaults and data location often differ between free, education and enterprise plans.
- Read the DPA against Article 28(3). Each of points (a) to (h) must be in the contract, not only in the questionnaire. Our DPA checker maps a draft agreement point by point.
- Check the subprocessor list and data flows. The EDPB says controllers should have the identity of all processors and subprocessors "readily available at all times" (Opinion 22/2024). Compare the list with the data locations and remote access answers, then use the transfer mechanism tool for each non-EEA recipient.
- Check certificates for scope and date. An ISO/IEC 27001 certificate or SOC 2 report matters only if it covers the product and hosting you are buying, and is current.
- Classify AI features. Use the AI Act checker for education for any feature that grades, admits, places or proctors students.
- Decide whether a DPIA is needed. Run the DPIA screening with what you have learned.
- Record conditions. Approve with conditions where needed, for example "SSO only" or "AI features switched off", and set a review date.
Red flags in vendor answers
Validemic's analysis
None of these answers is automatically disqualifying. Each one needs a follow-up question before approval.
| Answer pattern | Why it matters | Follow-up |
|---|---|---|
| "We are fully GDPR compliant" with no document | Compliance depends on contract, configuration and use | Ask for the DPA clause and the role statement |
| Data stored in the EU, access locations not stated | The EDPB treats remote access from a third country as a transfer | Ask where support and engineering staff access data from |
| Subprocessor list "available on request" | You need the identities now, and notice of changes later | Ask for the current list and the change notification method |
| Customer data "may be used to improve our services" | This can include AI training, and makes the vendor a controller for that use | Ask for a contractual commitment for your plan |
| "We notify breaches within 72 hours" | 72 hours is the controller's deadline; the processor must notify without undue delay | Ask for a shorter commitment, such as 24 or 48 hours |
| Certificate without scope, or an expired SOC 2 period | It may not cover the product, the hosting or the present | Ask for the scope statement and the latest report |
| Accessibility: "WCAG compliant" with no report | A claim without a test method and date cannot be checked | Ask for a conformance report against EN 301 549 V3.2.1 |
| Browser extension asks to read all websites | It can see email, the LMS and student records | Ask whether permissions can be limited by admin policy |
Unapproved tools often skip this review entirely. Our guide to shadow IT and AI tools in universities covers how to bring them into the process.
How universities run vendor assessments
Published university procedures show the same pattern: assessment is triggered by data or system access, its depth depends on risk or value, and it starts well before the contract.
- University of Aberdeen (UK). Its staff guidance from October 2020 uses contract value to choose the route: "If the total value of your contract is under £10,000, complete the Standard Assessment." Above that, the enhanced assessment uses the Scottish Government's Cyber Security Procurement Support Tool. The guidance says to allow about four weeks.
- University of Edinburgh (UK). Its guidance on cloud services asks staff to check negotiated agreements, data storage locations and encryption: "Check that any cloud service provider handling data on your behalf will encrypt it, both at rest and in transit."
- Luleå University of Technology (Sweden). Its guidelines for information security in procurement, based on guidance from the Swedish Civil Contingencies Agency (MSB), require requirements that are detailed and possible to evaluate, stating "which requirements are mandatory ("must") and which are non-mandatory ("should")".
- Montclair State University (US). It requires a security review for cloud and SaaS services before purchase, renewal or pilot, accepts HECVAT 3.x or newer, and says "Generally, vendor security reviews are valid for two years."
The builder follows the same logic: the intake sets the depth, and the output separates what to ask from what to verify.
Sources
All sources retrieved 9 October 2026. EU legal texts were read in the Official Journal versions from the Publications Office and are linked on EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), in particular Articles 3, 5, 8, 9, 22, 25, 27, 28, 30, 32 to 36, 44 to 49 and 89: eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Regulation (EU) 2024/1689 (AI Act), Articles 3, 4, 5, 6, 13 to 15, 25 to 27, 50 and 53 and Annex III: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Article 4, Article 50 transition and Article 113 dates: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
- Directive (EU) 2022/2555 (NIS2), Articles 2(5), 21 and 23 and Annexes I and II: eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
- Regulation (EU) 2023/2854 (Data Act), Articles 25 and 29: eur-lex.europa.eu/eli/reg/2023/2854/oj/eng
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 14 and 71: eur-lex.europa.eu/eli/reg/2024/2847/oj/eng
- Directive (EU) 2016/2102 (Web Accessibility Directive), Article 7: eur-lex.europa.eu/eli/dir/2016/2102/oj/eng
- Commission Implementing Decision (EU) 2021/1339 (reference of EN 301 549 V3.2.1): eur-lex.europa.eu/eli/dec_impl/2021/1339/oj/eng
- Directive 2014/24/EU (public procurement), Articles 4, 42(1) and 58(4): eur-lex.europa.eu/eli/dir/2014/24/oj/eng
- Commission Implementing Decision (EU) 2018/1523 (model accessibility statement): eur-lex.europa.eu/eli/dec_impl/2018/1523/oj/eng
- Directive 2002/58/EC (ePrivacy Directive), Article 5(3) as replaced by Directive 2009/136/EC: eur-lex.europa.eu/eli/dir/2009/136/oj/eng
- Commission Implementing Decision (EU) 2021/914 (standard contractual clauses), Clauses 14 and 15: eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng
- Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework): eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng
- EDPB, Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s), adopted 9 October 2024: edpb.europa.eu, Opinion 22/2024
- EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR: edpb.europa.eu, Guidelines 07/2020
- EDPB, Recommendations 01/2020 on supplementary measures for transfers, version 2.0, paragraph 13 (remote access is a transfer): edpb.europa.eu, Recommendations 01/2020
- ENISA, Good Practices for Supply Chain Cybersecurity (13 June 2023): enisa.europa.eu
- EDUCAUSE, Higher Education Community Vendor Assessment Toolkit (HECVAT): educause.edu (details as summarised in our HECVAT guide, checked 7 October 2026)
- ISO/IEC 27001:2022, Information security management systems: iso.org/standard/27001; ISO/IEC 42001:2023, AI management systems: iso.org/standard/42001
- ETSI EN 301 549 V3.2.1 (2021-03), Accessibility requirements for ICT products and services: etsi.org (PDF)
- 1EdTech, Learning Tools Interoperability (LTI 1.3 and LTI Advantage): 1edtech.org/standards/lti
- University of Aberdeen, "How to undertake a supplier assessment" (21 October 2020): abdn.ac.uk
- University of Edinburgh, Information Security, "Using cloud services": infosec.ed.ac.uk
- Luleå University of Technology, "Guidelines for information security in procurement and purchasing" (LTU-2486-2021, 4 December 2023): ltu.se (PDF)
- Montclair State University, Information Security, "Vendor Assessment (HECVAT)": inside.montclair.edu
About this page
We wrote the question bank from the legal texts and standards listed above, read on 9 October 2026, and from published university procedures. The questions are our own and are not taken from the HECVAT or any other licensed questionnaire. References point to the provision a question relies on; where a provision applies only in some cases (for example high-risk AI systems, or data processing services under the Data Act), the question says so. The pending GDPR changes in the Commission's Digital Omnibus proposal are not law and are not reflected. This tool is not legal advice, and the university remains responsible for its assessment. If you find an error or a reference that has changed, please contact us and we will correct it.
Frequently asked questions
What is a vendor security questionnaire?
It is a structured list of questions a buyer sends to a supplier before buying, to learn how the supplier protects data and meets legal duties. Good questionnaires ask for evidence such as certificates, contracts and subprocessor lists, not only for yes or no answers.
How many questions should a vendor questionnaire have?
As many as the risk needs and no more. A simple tool with little personal data may need about 20 questions, a typical service with student data or AI features 35 to 50, and a high-risk platform with special category data or minors 70 or more. Asking everything every time slows reviews and lowers answer quality.
Is there a HECVAT alternative for European universities?
The HECVAT is a broad security and privacy questionnaire from EDUCAUSE and remains useful evidence. European universities usually add questions on GDPR Article 28 processor terms, international transfers under Chapter V, the EU AI Act and EN 301 549 accessibility, because those laws need specific documents rather than general answers.
What should a GDPR vendor questionnaire include?
At minimum: the vendor's role for each purpose, a data processing agreement covering Article 28(3)(a) to (h), the subprocessor list and change process, data locations and remote access, the transfer tool for each non-EEA recipient, security measures, breach notification timing, and deletion or return of data at the end.
Do AI tools need extra vendor questions?
Yes. Ask whether your inputs and outputs are used to train models, which model providers process the data and where, how long prompts are kept, whether any feature is a high-risk use under Annex III point 3 of the AI Act, and how the vendor meets the Article 50 transparency duties.
Is the questionnaire builder free and private?
Yes. The tool runs entirely in your browser. Nothing you type or tick is stored or sent to Validemic or anyone else, and you can download the result as CSV or Markdown and edit it freely.