Vendor Due Diligence Questionnaire - California

California Compliance & Regulatory Updated September 12, 2026 Free Word and PDF

Draft it with AI

Answer a few questions and the AI editor drafts each section from your answers, on the California version. Review it, then export Word and PDF.

$99 one time, or $249/mo for everything

Ezel is drafting software, not a law firm. Editing by hand is free.

Or take the blank template

Enter your email and it downloads right away. No account needed.

VENDOR DUE DILIGENCE QUESTIONNAIRE — CALIFORNIA

Issuing Organization: [________________________________]
Date Issued: [__/__/____]
Due Date for Completion: [__/__/____]
Vendor Risk Tier: ☐ Critical | ☐ High | ☐ Medium | ☐ Low

Instructions and Scope
Vendor Profile and Ownership
Sanctions, PEP, and Adverse Media
Services, Data, and Locations
Information Security Controls
Privacy and Data Subject Rights
Subprocessors and Fourth Parties
Incident Response and Breach History
Business Continuity and Disaster Recovery
Certifications, Audits, and Testing
Insurance Coverage
Legal and Regulatory Matters
Financial Viability
ESG, Ethics, and Anti-Corruption
California-Specific Compliance Requirements
Required Artifacts Checklist
Attestation and Signoff

1. INSTRUCTIONS AND SCOPE

1.1 Purpose

This VDQ evaluates vendor risk with specific attention to California's comprehensive privacy framework under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) (Cal. Civ. Code § 1798.100 et seq.), including service provider and contractor obligations, the California data breach notification statute (Cal. Civ. Code § 1798.82), and the CPPA's final implementing regulations (11 CCR § 7050 et seq.). The CPRA enhanced requirements for service providers and contractors, including restrictions on use, retention, and disclosure of personal information.

1.2 Completion Instructions

Complete all sections; enter "N/A" where not applicable.
Attach all requested evidence. Critical/High-tier vendors must provide independent evidence.

2. VENDOR PROFILE AND OWNERSHIP

Field	Response
Legal Entity Name	[________________________________]
DBA	[________________________________]
Date of Incorporation	[__/__/____]
Jurisdiction	[________________________________]
Principal Address	[________________________________]
California Office (if any)	[________________________________]
Website	[________________________________]
EIN	[________________________________]
CA SOS Entity No.	[________________________________]
Entity Type	☐ Corporation ☐ LLC ☐ Partnership ☐ Other: [____]

Beneficial Owners (10%+):

Name	Title	Ownership %	Residence
[________________________________]	[________________]	[____]%	[________________]

Key Contacts:

Role	Name	Email	Phone
Primary Business	[________________]	[________________]	[________________]
Security Lead	[________________]	[________________]	[________________]
Privacy Officer	[________________]	[________________]	[________________]
Incident Response	[________________]	[________________]	[________________]

3. SANCTIONS, PEP, AND ADVERSE MEDIA

List	Screened	Match
OFAC SDN	☐ Yes ☐ No	☐ Yes ☐ No
UN Consolidated	☐ Yes ☐ No	☐ Yes ☐ No
EU Consolidated	☐ Yes ☐ No	☐ Yes ☐ No

PEP among owners/officers? ☐ Yes ☐ No

Adverse media in past 5 years? ☐ Yes ☐ No

4. SERVICES, DATA, AND LOCATIONS

Field	Response
Services description	[________________________________]
Criticality	☐ Critical ☐ High ☐ Medium ☐ Low
System access	☐ Yes ☐ No
Access type	☐ Read-only ☐ Read/Write ☐ Admin ☐ N/A

Data Categories:

☐ Personal information (as defined in Cal. Civ. Code § 1798.140(v))
☐ Sensitive personal information (§ 1798.140(ae))
☐ SSN / government identifiers
☐ Financial account information
☐ Precise geolocation
☐ Racial/ethnic origin
☐ Religious/philosophical beliefs
☐ Union membership
☐ Genetic data
☐ Biometric data for identification
☐ Health information
☐ Sex life / sexual orientation
☐ Contents of mail, email, text messages (non-recipient)
☐ Children's data (under 16)
☐ PCI data
☐ PHI
☐ Other: [________________________________]

Volume: ☐ <1,000 ☐ 1,000–10,000 ☐ 10,000–100,000 ☐ 100,000–1M ☐ >1M

Locations:

Location	Activity	Data Types
[________________________________]	☐ Processing ☐ Storage ☐ Both	[________________]

5. INFORMATION SECURITY CONTROLS

5.1 Access Controls

#	Control	Response	Details
5.1.1	MFA for remote access?	☐ Yes ☐ No	[________________]
5.1.2	MFA for data access?	☐ Yes ☐ No	[________________]
5.1.3	RBAC?	☐ Yes ☐ No	[________________]
5.1.4	Least privilege?	☐ Yes ☐ No ☐ Partial	[________________]
5.1.5	Access reviews?	☐ Yes ☐ No	Frequency: [____]

5.2 Encryption

#	Control	Response	Details
5.2.1	At rest?	☐ Yes ☐ No	Algorithm: [____]
5.2.2	In transit?	☐ Yes ☐ No	Protocol: [____]

5.3 Network and Infrastructure

#	Control	Response	Details
5.3.1	Firewalls?	☐ Yes ☐ No	[________________]
5.3.2	IDS/IPS?	☐ Yes ☐ No	[________________]
5.3.3	Patch management?	☐ Yes ☐ No	SLA: [____]
5.3.4	Vulnerability scanning?	☐ Yes ☐ No	Frequency: [____]

5.4 Endpoint, Physical, Logging

#	Control	Response	Details
5.4.1	EDR?	☐ Yes ☐ No	[________________]
5.4.2	Centralized logging/SIEM?	☐ Yes ☐ No	[________________]
5.4.3	Physical security?	☐ Yes ☐ No	[________________]

6. PRIVACY AND DATA SUBJECT RIGHTS

#	Control	Response
6.1	Privacy officer?	☐ Yes ☐ No
6.2	Privacy policy?	☐ Yes ☐ No
6.3	Data retention schedules?	☐ Yes ☐ No
6.4	Secure deletion?	☐ Yes ☐ No
6.5	Deletion certification?	☐ Yes ☐ No

7. SUBPROCESSORS

Uses subprocessors? ☐ Yes ☐ No

Subprocessor	Services	Location	Data Types
[________________________________]	[________________]	[________________]	[________________]

#	Control	Response
7.1	Due diligence?	☐ Yes ☐ No
7.2	Equivalent terms?	☐ Yes ☐ No
7.3	Change notification?	☐ Yes ☐ No

8. INCIDENT RESPONSE

#	Control	Response	Details
8.1	Documented IRP?	☐ Yes ☐ No	[________________]
8.2	24/7 response?	☐ Yes ☐ No	[________________]
8.3	Customer notification SLA	[____] hours

Breaches in past 3 years? ☐ Yes ☐ No

9. BC/DR

#	Control	Response
9.1	BCP?	☐ Yes ☐ No
9.2	DRP?	☐ Yes ☐ No
9.3	RTO	[____] hours
9.4	RPO	[____] hours

10. CERTIFICATIONS

Certification	Maintained	Covers Services	Expiration
SOC 2 Type II	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]
ISO 27001	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]
PCI DSS	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]

11. INSURANCE

Coverage	Carrier	Limit	Expiration
Cyber/Tech E&O	[________________]	$[________________]	[__/__/____]
General Liability	[________________]	$[________________]	[__/__/____]

12. LEGAL AND REGULATORY

#	Question	Response
12.1	Required licenses?	☐ Yes ☐ No
12.2	Regulatory exams?	☐ Yes ☐ No
12.3	Enforcement actions?	☐ Yes ☐ No
12.4	Pending litigation?	☐ Yes ☐ No

13. FINANCIAL VIABILITY

#	Question	Response
13.1	Provide financials?	☐ Yes ☐ No
13.2	Material adverse changes?	☐ Yes ☐ No

14. ESG AND ETHICS

#	Control	Response
14.1	Code of conduct?	☐ Yes ☐ No
14.2	Anti-corruption?	☐ Yes ☐ No
14.3	Whistleblower channel?	☐ Yes ☐ No

15. CALIFORNIA-SPECIFIC COMPLIANCE REQUIREMENTS

15.1 CCPA/CPRA Service Provider and Contractor Obligations

Cal. Civ. Code § 1798.100(d) requires the covered agreement to: (1) specify limited and specified purposes; (2) obligate compliance with applicable duties under the title and the same level of privacy protection; (3) grant the business reasonable and appropriate step rights; (4) require notice if the recipient determines it can no longer meet its obligations; and (5) grant stop-and-remediate rights. Separately identify the current definition or regulation supporting any no-sale, use, retention, disclosure, combination, audit, or subcontractor term.

#	Requirement	Response	Details
15.1.1	Will the vendor enter into a CPRA-compliant service provider or contractor agreement (§ 1798.100(d))?	☐ Yes ☐ No	[________________]
15.1.2	Does the vendor certify it will not retain, use, or disclose personal information for any purpose other than the contracted services (§ 1798.140(ag)(1)(A))?	☐ Yes ☐ No	[________________]
15.1.3	Does the vendor certify it will not sell or share personal information (§ 1798.140(ag)(1)(B))?	☐ Yes ☐ No	[________________]
15.1.4	Does the vendor certify it will not combine personal information from multiple businesses without authorization (§ 1798.140(ag)(1)(D))?	☐ Yes ☐ No	[________________]
15.1.5	Will the vendor notify the business if it determines it can no longer meet CCPA obligations (§ 1798.100(d)(4))?	☐ Yes ☐ No	[________________]
15.1.6	Will the vendor grant the business rights to take reasonable and appropriate steps to help ensure CCPA-consistent use (§ 1798.100(d)(3))? Identify any separately authorized audit mechanism.	☐ Yes ☐ No	[________________]
15.1.7	Does the vendor flow down equivalent service provider/contractor restrictions to its subcontractors?	☐ Yes ☐ No	[________________]

15.2 Consumer Rights Support

#	Requirement	Response	Details
15.2.1	Can the vendor support Right to Know / Access requests (§ 1798.100)?	☐ Yes ☐ No	Timeline: [____] days
15.2.2	Can the vendor support Right to Delete requests (§ 1798.105)?	☐ Yes ☐ No	Timeline: [____] days
15.2.3	Can the vendor support Right to Correct requests (§ 1798.106)?	☐ Yes ☐ No	Timeline: [____] days
15.2.4	Can the vendor support applicable data-portability requests? Current authority/procedure: [________________]	☐ Yes ☐ No	[________________]
15.2.5	Can the vendor support Opt-Out of Sale/Sharing (§ 1798.120)?	☐ Yes ☐ No	[________________]
15.2.6	Can the vendor support Right to Limit Use of Sensitive PI (§ 1798.121)?	☐ Yes ☐ No	[________________]
15.2.7	Can the vendor respond to verified consumer requests within 45 days (extendable by 45 days) (11 CCR § 7024)?	☐ Yes ☐ No	[________________]
15.2.8	Does the vendor recognize Global Privacy Control (GPC) as a valid opt-out signal per § 1798.135 and 11 CCR § 7025?	☐ Yes ☐ No	[________________]

15.3 Sensitive Personal Information (§ 1798.140(ae))

#	Requirement	Response	Details
15.3.1	Does the vendor process sensitive personal information of California consumers?	☐ Yes ☐ No	Types: [________________]
15.3.2	If yes, is processing limited to what is necessary and proportionate (§ 1798.121(a))?	☐ Yes ☐ No ☐ N/A	[________________]
15.3.3	Does the vendor support the "Limit the Use of My Sensitive Personal Information" mechanism?	☐ Yes ☐ No ☐ N/A	[________________]

15.4 Automated Decision-Making Technology (ADMT)

The CPPA's adopted ADMT regulations are effective January 1, 2026, but covered businesses must comply with the ADMT requirements beginning January 1, 2027. Use this section to assess implementation readiness before that date and compliance afterward.

#	Requirement	Response	Details
15.4.1	Does the vendor use automated decision-making technology in processing our data?	☐ Yes ☐ No	[________________]
15.4.2	If yes, does the vendor support ADMT transparency, access, and opt-out obligations?	☐ Yes ☐ No ☐ N/A	[________________]
15.4.3	Can the vendor support risk assessments for ADMT processing?	☐ Yes ☐ No ☐ N/A	[________________]

15.5 Breach Notification (Cal. Civ. Code § 1798.82)

California requires notification "in the most expedient time possible and without unreasonable delay" to residents whose unencrypted personal information was acquired by an unauthorized person. If >500 California residents are affected, a sample notification must be submitted to the California AG.

#	Requirement	Response	Details
15.5.1	Can the vendor notify us promptly to allow compliance with California's breach notification requirement?	☐ Yes ☐ No	SLA: [____] hours
15.5.2	Can the vendor support AG notification when >500 CA residents are affected (§ 1798.82(f))?	☐ Yes ☐ No	[________________]
15.5.3	Can the vendor provide notification content required under § 1798.82(d)?	☐ Yes ☐ No	[________________]

15.6 Data Retention and Disposal

#	Requirement	Response	Details
15.6.1	Are retention periods limited to what is reasonably necessary for the disclosed purpose (§ 1798.100(a)(3))?	☐ Yes ☐ No	Period: [________________]
15.6.2	Will the vendor certify deletion of PI upon contract termination?	☐ Yes ☐ No	[________________]

16. REQUIRED ARTIFACTS CHECKLIST

#	Document	Provided	N/A
16.1	Information Security Policy	☐	☐
16.2	Privacy Policy	☐	☐
16.3	Incident Response Plan	☐	☐
16.4	BC/DR Plan	☐	☐
16.5	SOC 2 Report	☐	☐
16.6	Pen Test Summary	☐	☐
16.7	Subprocessor List	☐	☐
16.8	Insurance Certificate(s)	☐	☐
16.9	CPRA Service Provider/Contractor Agreement	☐	☐
16.10	DPA / Security Addendum	☐	☐

17. ATTESTATION AND SIGNOFF

I certify that the information provided is true, complete, and accurate. I commit to notifying the issuing organization within ten (10) business days of material changes.

Field	Information
Name	[________________________________]
Title	[________________________________]
Signature	[________________________________]
Date	[__/__/____]

SOURCES AND REFERENCES

California Consumer Privacy Act / CPRA, Cal. Civ. Code § 1798.100 et seq.
Cal. Civ. Code § 1798.140(ag) (Service Provider Definition)
Cal. Civ. Code § 1798.140(ae) (Sensitive Personal Information)
Cal. Civ. Code § 1798.82 (Breach Notification)
CPPA Final Regulations, 11 CCR § 7050 et seq.
11 CCR § 7025 (Opt-Out Preference Signals, Including GPC)
11 CCR § 7030 et seq. (ADMT Regulations; compliance begins January 1, 2027)
OCC Bulletin 2023-17, "Third-Party Relationships: Risk Management Guidance" (risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; not law)

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.

Insert Image

Insert Table

Need to customize this document?

About this template

Last updated: September 12, 2026
Jurisdiction: California
Category: Compliance & Regulatory

Legal authority

California Consumer Privacy Act / CPRA, Cal. Civ. Code § 1798.100 et seq.
Cal. Civ. Code § 1798.140(ag) (Service Provider Definition)
Cal. Civ. Code § 1798.100(d) (Service Provider Obligations)
Cal. Civ. Code § 1798.82 (Breach Notification)
CCPA Regulations, 11 CCR § 7050 et seq. (CPPA Final Regulations)
OCC Bulletin 2023-17 (Risk-Based Supervisory Guidance for Banking Organizations; Not Law)

Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.

Not legal advice

This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.

Checked against the law it cites

The statutes this template relies on are listed under Legal authority.

Cal. Civ. Code § 1798.100(d)(1)-(5) (checked September 12, 2026): "Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes. Obligates the third party, service provider, or contractor to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title. Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title. Requires the third party, service provider, or contractor to notify the business if it makes a determination that it can no longer meet its obligations under this title. Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information."

OCC Bulletin 2023-17 / 88 Fed. Reg. 37920 (checked September 6, 2026): "This guidance is relevant to all banking organizations supervised by the agencies. Supervisory guidance does not have the force and effect of law and does not impose any new requirements on banking organizations."

Draft your Vendor Due Diligence Questionnaire - California in the editor

Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.