Third-party vendor and integration review (GDPR / ePrivacy)

Third-party vendor and integration review (GDPR / ePrivacy)

Assessment of an external service before it enters a product, and the internal records that assessment must produce. Governing texts: Regulation (EU) 2016/679 (GDPR), in particular Art 4(7)/(8), Art 26, Art 28, Art 30, Art 35 and Chapter V; Directive 2002/58/EC (ePrivacy) Art 5(3) as transposed nationally; Commission Implementing Decision (EU) 2021/914 (SCCs); Regulation (EU) 2024/1689 (AI Act) where the vendor is an AI system or GPAI model.

Core principle: "Is this vendor GDPR compliant?" has no answer. Compliance is a property of a deployment, not of a company — the controller carries accountability under Art 5(2) GDPR and cannot inherit it from a vendor badge. Six questions are answerable, and every one of them produces a document:

1. What personal data does this integration actually transmit? — verified on the wire, not from the vendor's marketing page.
2. Is the vendor a processor, an independent controller, or a joint controller for that flow? — per flow, not per company.
3. Is there an Art 28 contract in force that covers it? — in force, not merely published.
4. Which Chapter V mechanism carries the data out of the EEA? — including the sub-processor layer.
5. Does it store or access anything on the user's device, and does it fire before consent?
6. What does each answer oblige you to write down? — ROPA entry, notice paragraph, consent category, sub-processor entry, retention statement, DPIA trigger.

Limits

This skill produces internal assessment records and draft artefacts, not legal advice.

• A DPO, privacy counsel or the competent supervisory authority signs off on: joint-controller arrangements under Art 26, any transfer where the vendor cannot name a valid mechanism, special-category data under Art 9, children's data, and any DPIA that ends in a residual high risk (Art 36 prior consultation).
• Every produced artefact carries <!-- DRAFT – not legally approved --> until that sign-off is confirmed. Never remove the marker silently.
• Every entry in references/vendors.md, references/vendors-saas.md and references/ai-vendors.md is a dated snapshot. Vendor terms change without notice. Re-verify against the vendor's live legal page before relying on any line, and re-date it. A snapshot older than the current quarter is a lead, not a finding.

Boundary. This skill assesses integrations and writes internal documentation. The published privacy notice, imprint, terms and cookie-policy text belongs to the legal-* skills; here you produce the factual paragraph content those texts consume.

Workflow

1. Intake. Answer references/intake.md first. Unanswered items become [[MISSING: …]]; never guess an integration's behaviour.
2. Observe the flow. references/data-inventory.md — capture what the integration actually sends before reading any vendor claim.
3. Work the six questions in order, reading the matching reference file before writing anything. Question 2 decides which contract exists at all; question 5 decides whether the integration may load at page load.
4. Produce the artefacts from references/artefacts.md.
5. Run references/checklist.md. Report findings with the article and the location, not as reassurance.
6. Decide. Approve with artefacts attached, or reject with the single blocking finding named and the nearest compliant alternative.

Output shape. Four parts, in this order:

1. the artefacts (ROPA entry, notice paragraph, consent category, sub-processor entry, retention statement) with the draft marker, or the rejection with its blocking finding
2. the [[MISSING: …]] list the user must supply
3. adjacent open items, one sentence each
4. the sign-off note

Reference file names never appear in the delivered output.

Decision matrix

Hard rules

• "GDPR compliant" is not a finding. Art 5(2) puts accountability on the controller. A vendor's ISO 27001, SOC 2, TISAX or self-declared "GDPR ready" badge says nothing about Art 28, Art 30 or Chapter V for your deployment. Record the six answers, not the badge.
• ePrivacy Art 5(3) does not care whether it is personal data. Art 5(3) Directive 2002/58/EC covers "the storing of information, or the gaining of access to information already stored" on a subscriber's or user's terminal equipment. EDPB Guidelines 2/2023 on the technical scope of Art 5(3), Version 2.0, adopted 07.10.2024, confirm the threshold is information, not personal data, and analyse URL and pixel tracking, local processing, IP-only tracking, IoT reporting and unique identifiers. "No cookies, only localStorage", "only a fingerprint" and "only a tracking pixel" are all inside the rule.
• Check the DPF entity, not the brand. EU-US Data Privacy Framework participation attaches to a named legal entity with a scope (HR data / non-HR data) and a status. Verify the exact contracting entity on dataprivacyframework.gov/list and record the certification status and date. A parent company's certification does not cover a subsidiary that is not listed.
• A third-party tag is your transfer. EDPB Guidelines 05/2021 v2.0 (14.02.2023): personal data disclosed via cookies is "not considered as being disclosed directly by the data subject, but rather as a transmission by the operator of the website that the data subject is visiting". The site operator is the exporter for every third-country script its page loads — the visitor's browser making the request does not shift that.
• An EU region does not end the transfer question. Remote access from a third country — support, on-call engineering, a US-based sub-processor — is a transfer under Chapter V (EDPB Guidelines 05/2021 on the interplay of Art 3 and Chapter V). Ask where support sits and where sub-processors sit, not only where the bucket sits.
• A published DPA is not a DPA in force. Art 28(9) requires the contract in writing, including electronic form. Determine whether the master terms incorporate the addendum by reference automatically or whether an acceptance step exists in the dashboard. If an acceptance step exists and was never performed, the processing has no Art 28 basis — that is a blocking finding, not a to-do.
• A vendor that reserves its own use rights is not your processor for that use. Art 28(3)(a) requires processing only on documented instructions. Terms permitting the vendor to use the data for its own product improvement, benchmarking, model training or ad measurement describe an independent controller (or joint controller) for that purpose, which needs its own legal basis and its own notice paragraph.
• Never write a retention period you cannot point at a setting for. If the vendor's dashboard has no retention control and the terms name no period, the answer is [[MISSING: retention period — no vendor setting found]], not "as long as necessary".
• Never invent the user's stack. Contracting entity, region setting, plan tier, signed DPA date, consent-manager category and legal basis are facts about the user's deployment. Unknown values become [[MISSING: …]] in the artefact and in the report.
• The vendor reference files expire. Treat every line in vendors.md and ai-vendors.md as valid only for the date stamped on it. Re-check the vendor's own page before approving.

False friends

Common mistakes

Reference files

• references/intake.md — questions to answer before any assessment
• references/data-inventory.md — establishing what the integration actually transmits
• references/role-determination.md — controller / processor / joint controller test and the cases that break it
• references/processor-contract.md — Art 28(3) checklist, sub-processor chain, audit rights
• references/transfers.md — Chapter V, adequacy list, DPF, SCC modules, TIA, UK and Swiss variants
• references/device-access.md — ePrivacy Art 5(3), consent gating, CMP category assignment
• references/artefacts.md — ROPA entry, notice paragraph, retention statement, sub-processor entry
• references/dpia.md — Art 35 trigger test and national blacklists
• references/vendors.md — dated findings: infrastructure, analytics, payments, ad platforms
• references/vendors-saas.md — dated findings: email, support, embeds, forms, workplace tools
• references/ai-vendors.md — LLM and AI APIs: training defaults, retention, ZDR, AI Act
• references/enforcement.md — decisions and regulatory positions with citations
• references/checklist.md — pre-approval gate producing findings