Vendor Due Diligence Questionnaire - Texas

Texas Compliance & Regulatory Updated September 27, 2026 Free Word and PDF

Draft it with AI

Answer a few questions and the AI editor drafts each section from your answers, on the Texas version. Review it, then export Word and PDF.

$99 one time, or $249/mo for everything

Ezel is drafting software, not a law firm. Editing by hand is free.

Or take the blank template

Enter your email and it downloads right away. No account needed.

VENDOR DUE DILIGENCE QUESTIONNAIRE — TEXAS

Issuing Organization: [________________________________]
Date Issued: [__/__/____]
Due Date for Completion: [__/__/____]
Vendor Risk Tier: ☐ Critical | ☐ High | ☐ Medium | ☐ Low

Instructions and Scope
Vendor Profile and Ownership
Sanctions, PEP, and Adverse Media
Services, Data, and Locations
Information Security Controls
Privacy and Data Subject Rights
Subprocessors and Fourth Parties
Incident Response and Breach History
Business Continuity and Disaster Recovery
Certifications, Audits, and Testing
Insurance Coverage
Legal and Regulatory Matters
Financial Viability
ESG, Ethics, and Anti-Corruption
Texas-Specific Compliance Requirements
Required Artifacts Checklist
Attestation and Signoff

1. INSTRUCTIONS AND SCOPE

1.1 Purpose

This VDQ evaluates vendor risk with attention to Texas's privacy and data security framework, including the Texas Data Privacy and Security Act (TDPSA) (Tex. Bus. & Com. Code Ch. 541, effective July 1, 2024), the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code § 521.053), and the Capture or Use of Biometric Identifier Act (CUBI) (Tex. Bus. & Com. Code § 503.001). The TDPSA establishes consumer privacy rights and processor obligations; the breach notification statute requires notice to affected Texas residents "as quickly as possible" without unreasonable delay, and no later than 60 days after breach determination.

1.2 Completion Instructions

Complete all sections; enter "N/A" with explanation where not applicable.
Attach requested evidence. Critical/High-tier vendors must provide independent evidence.

2. VENDOR PROFILE AND OWNERSHIP

Field	Response
Legal Entity Name	[________________________________]
DBA	[________________________________]
Date of Incorporation	[__/__/____]
Jurisdiction	[________________________________]
Principal Address	[________________________________]
Texas Office (if any)	[________________________________]
Website	[________________________________]
EIN	[________________________________]
TX SOS Filing No.	[________________________________]
Entity Type	☐ Corporation ☐ LLC ☐ Partnership ☐ Other: [____]

Beneficial Owners (10%+):

Name	Title	Ownership %	Residence
[________________________________]	[________________]	[____]%	[________________]

Key Contacts:

Role	Name	Email	Phone
Primary Business	[________________]	[________________]	[________________]
Security Lead	[________________]	[________________]	[________________]
Privacy Officer	[________________]	[________________]	[________________]
Incident Response	[________________]	[________________]	[________________]

3. SANCTIONS, PEP, AND ADVERSE MEDIA

List	Screened	Match
OFAC SDN	☐ Yes ☐ No	☐ Yes ☐ No
UN Consolidated	☐ Yes ☐ No	☐ Yes ☐ No
EU Consolidated	☐ Yes ☐ No	☐ Yes ☐ No

PEP among owners/officers? ☐ Yes ☐ No

Adverse media in past 5 years? ☐ Yes ☐ No

4. SERVICES, DATA, AND LOCATIONS

Field	Response
Services description	[________________________________]
Criticality	☐ Critical ☐ High ☐ Medium ☐ Low
System access	☐ Yes ☐ No
Access type	☐ Read-only ☐ Read/Write ☐ Admin ☐ N/A

Data Categories:

☐ Personal data (as defined under TDPSA, Tex. Bus. & Com. Code § 541.001)
☐ Sensitive data (TDPSA: racial/ethnic origin, religious beliefs, health/mental health, sexuality, citizenship, genetic/biometric, children's data, precise geolocation)
☐ SSN
☐ Financial account numbers
☐ Driver's license numbers
☐ Biometric identifiers (CUBI, § 503.001)
☐ PCI data
☐ PHI
☐ Other: [________________________________]

Volume: ☐ <1,000 ☐ 1,000–10,000 ☐ 10,000–100,000 ☐ 100,000–1M ☐ >1M

Locations:

Location	Activity	Data Types
[________________________________]	☐ Processing ☐ Storage ☐ Both	[________________]

5. INFORMATION SECURITY CONTROLS

5.1 Access Controls

#	Control	Response	Details
5.1.1	MFA for remote access?	☐ Yes ☐ No	[________________]
5.1.2	MFA for data access?	☐ Yes ☐ No	[________________]
5.1.3	RBAC?	☐ Yes ☐ No	[________________]
5.1.4	Least privilege?	☐ Yes ☐ No ☐ Partial	[________________]
5.1.5	Access reviews?	☐ Yes ☐ No	Frequency: [____]

5.2 Encryption

#	Control	Response	Details
5.2.1	At rest?	☐ Yes ☐ No	Algorithm: [____]
5.2.2	In transit?	☐ Yes ☐ No	Protocol: [____]

5.3 Network and Infrastructure

#	Control	Response	Details
5.3.1	Firewalls?	☐ Yes ☐ No	[________________]
5.3.2	IDS/IPS?	☐ Yes ☐ No	[________________]
5.3.3	Patch management?	☐ Yes ☐ No	SLA: [____]
5.3.4	Vulnerability scanning?	☐ Yes ☐ No	Frequency: [____]

5.4 Endpoint, Physical, Logging

#	Control	Response	Details
5.4.1	EDR?	☐ Yes ☐ No	[________________]
5.4.2	Centralized logging?	☐ Yes ☐ No	[________________]
5.4.3	Physical security?	☐ Yes ☐ No	[________________]

6. PRIVACY AND DATA SUBJECT RIGHTS

#	Control	Response
6.1	Privacy officer?	☐ Yes ☐ No
6.2	Privacy policy?	☐ Yes ☐ No
6.3	Data retention schedules?	☐ Yes ☐ No
6.4	Secure deletion?	☐ Yes ☐ No
6.5	Deletion certification?	☐ Yes ☐ No

7. SUBPROCESSORS

Uses subprocessors? ☐ Yes ☐ No

Subprocessor	Services	Location	Data Types
[________________________________]	[________________]	[________________]	[________________]

#	Control	Response
7.1	Due diligence on subprocessors?	☐ Yes ☐ No
7.2	Equivalent contractual terms?	☐ Yes ☐ No
7.3	Change notification?	☐ Yes ☐ No

8. INCIDENT RESPONSE AND BREACH HISTORY

#	Control	Response	Details
8.1	Documented IRP?	☐ Yes ☐ No	[________________]
8.2	24/7 response?	☐ Yes ☐ No	[________________]
8.3	Customer notification SLA	[____] hours
8.4	IRP tested annually?	☐ Yes ☐ No	Last: [__/__/____]

Breaches in past 3 years? ☐ Yes ☐ No

9. BUSINESS CONTINUITY AND DISASTER RECOVERY

#	Control	Response
9.1	BCP?	☐ Yes ☐ No
9.2	DRP?	☐ Yes ☐ No
9.3	RTO	[____] hours
9.4	RPO	[____] hours
9.5	DRP tested annually?	☐ Yes ☐ No

10. CERTIFICATIONS

Certification	Maintained	Covers Services	Expiration
SOC 2 Type II	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]
ISO 27001	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]
PCI DSS	☐ Yes ☐ No	☐ Yes ☐ No	[__/__/____]

11. INSURANCE

Coverage	Carrier	Limit	Expiration
Cyber/Tech E&O	[________________]	$[________________]	[__/__/____]
General Liability	[________________]	$[________________]	[__/__/____]

12. LEGAL AND REGULATORY

#	Question	Response
12.1	Required licenses held?	☐ Yes ☐ No
12.2	Regulatory exams?	☐ Yes ☐ No
12.3	Enforcement actions?	☐ Yes ☐ No
12.4	Pending litigation?	☐ Yes ☐ No

13. FINANCIAL VIABILITY

#	Question	Response
13.1	Provide financials?	☐ Yes ☐ No
13.2	Material adverse changes?	☐ Yes ☐ No

14. ESG AND ETHICS

#	Control	Response
14.1	Code of conduct?	☐ Yes ☐ No
14.2	Anti-corruption program?	☐ Yes ☐ No
14.3	Whistleblower channel?	☐ Yes ☐ No

15. TEXAS-SPECIFIC COMPLIANCE REQUIREMENTS

15.1 Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code Ch. 541

The TDPSA, effective July 1, 2024, applies to persons conducting business in Texas or producing products or services consumed by Texas residents, excluding small businesses as defined by the SBA (unless the entity sells sensitive data). The TDPSA establishes consumer rights and processor/controller obligations.

#	Requirement	Response	Details
15.1.1	Does the vendor process personal data of Texas consumers as a "processor" under the TDPSA (§ 541.001(23))?	☐ Yes ☐ No	[________________]
15.1.2	Does the vendor adhere to controller instructions and provide the assistance required by § 541.104(a)?	☐ Yes ☐ No	[________________]
15.1.3	Can the vendor support the following Texas consumer rights requests: access, correction, deletion, data portability, opt-out of targeted advertising, opt-out of sale of personal data, opt-out of profiling (§ 541.051)?	☐ Yes ☐ No	[________________]
15.1.4	Can the vendor support responses without undue delay and no later than 45 days, with one conditional 45-day extension and timely notice (§ 541.052(b))?	☐ Yes ☐ No	[________________]
15.1.5	Can the vendor support technology-based authorized-agent requests that qualify under § 541.055(e)-(f), including the statutory verification requirements and exceptions?	☐ Yes ☐ No	[________________]
15.1.6	Can the vendor provide information enabling assessments for the processing listed in § 541.105(a) and the analysis in subsection (b)?	☐ Yes ☐ No	[________________]
15.1.7	Can the vendor assist the controller with processing security and breach-notice requirements under § 541.104(a)(2)?	☐ Yes ☐ No	[________________]
15.1.8	Will the vendor delete or return personal data at the controller's direction after service completion, subject to required legal retention (§ 541.104(b)(6)(B))?	☐ Yes ☐ No	[________________]
15.1.9	Will the vendor allow and cooperate with reasonable assessments (§ 541.104(b)(6)(D))?	☐ Yes ☐ No	[________________]

15.2 Sensitive Data Under TDPSA (§ 541.001(29))

#	Requirement	Response	Details
15.2.1	Does the vendor process sensitive data of Texas consumers?	☐ Yes ☐ No	Types: [________________]
15.2.2	If yes, does the controller obtain consent before processing sensitive data (§ 541.101(b)(4))?	☐ Yes ☐ No ☐ N/A	[________________]
15.2.3	For known-child sensitive data: is processing conducted in accordance with COPPA (§ 541.101(b)(4))?	☐ Yes ☐ No ☐ N/A	[________________]

15.3 Biometric Data — CUBI (Tex. Bus. & Com. Code § 503.001)

Tex. Bus. & Com. Code § 503.001 requires advance notice and consent for commercial capture of a biometric identifier, subject to its specific exceptions, including certain AI development and training activities. For covered identifiers, subsection (c) sets care, disclosure and destruction rules, with a longer-record rule in subsection (c-1). Record the vendor's actual use and the applicable subsection.

#	Requirement	Response	Details
15.3.1	Does the vendor capture, use, or possess biometric identifiers of Texas residents?	☐ Yes ☐ No	Types: [________________]
15.3.2	Has the vendor determined whether commercial capture is covered or an § 503.001(e) exception applies, and obtained subsection (b) notice and consent if required?	☐ Yes ☐ No ☐ N/A	Method and basis: [________________]
15.3.3	Does the vendor follow the applicable destruction rule in § 503.001(c)(3) or (c-1)?	☐ Yes ☐ No ☐ N/A	[________________]
15.3.4	Has the vendor checked any sale, lease or disclosure against § 503.001(c)(1)'s permitted routes?	☐ Yes ☐ No ☐ N/A	[________________]
15.3.5	Does the vendor store, transmit, and protect biometric identifiers using reasonable care and at least the same standard as other confidential information (§ 503.001(c)(2))?	☐ Yes ☐ No ☐ N/A	[________________]

15.4 Breach Notification — Tex. Bus. & Com. Code § 521.053

Texas requires notification to affected individuals without unreasonable delay and not later than 60 days after determination of a breach (§ 521.053(b)). If 250 or more Texas residents are affected, notice must also be given to the Texas Attorney General as soon as practicable and not later than 30 days after determination, submitted electronically via the AG's website form (§ 521.053(i)). Effective September 1, 2023, S.B. 768 shortened the Attorney General deadline from 60 to 30 days and made the electronic form mandatory. (The Texas Data Privacy and Security Act, H.B. 4, is a separate law effective July 1, 2024.)

#	Requirement	Response	Details
15.4.1	Can the vendor notify us within contractual SLA to allow compliance with 60-day notification deadline?	☐ Yes ☐ No	SLA: [____] hours
15.4.2	Can the vendor support electronic AG notification when at least 250 Texas residents are involved?	☐ Yes ☐ No	[________________]
15.4.3	Can the vendor provide breach notification content required under § 521.053?	☐ Yes ☐ No	[________________]

16. REQUIRED ARTIFACTS CHECKLIST

#	Document	Provided	N/A
16.1	Information Security Policy	☐	☐
16.2	Privacy Policy	☐	☐
16.3	Incident Response Plan	☐	☐
16.4	BC/DR Plan	☐	☐
16.5	SOC 2 Report	☐	☐
16.6	Pen Test Summary	☐	☐
16.7	Subprocessor List	☐	☐
16.8	Insurance Certificate(s)	☐	☐
16.9	CUBI applicability, exception and control record (if biometrics)	☐	☐
16.10	DPA / Security Addendum	☐	☐

17. ATTESTATION AND SIGNOFF

I certify that the information provided is true, complete, and accurate. I commit to notifying the issuing organization within ten (10) business days of material changes.

Field	Information
Name	[________________________________]
Title	[________________________________]
Signature	[________________________________]
Date	[__/__/____]

SOURCES AND REFERENCES

Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code Ch. 541 (eff. July 1, 2024)
Tex. Bus. & Com. Code § 521.053 (Breach Notification; 60-day individual / 30-day Attorney General deadline)
Tex. Bus. & Com. Code § 503.001 (Capture or Use of Biometric Identifier Act — CUBI)
S.B. 768 (88th Legislature, 2023; eff. 9/1/2023) shortening the § 521.053 Attorney General breach-notice deadline from 60 to 30 days
OCC Bulletin 2023-17, "Third-Party Relationships: Risk Management Guidance" (risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; not law)
FFIEC IT Examination Handbook

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.

Insert Image

Insert Table

Need to customize this document?

About this template

Last updated: September 27, 2026
Jurisdiction: Texas
Category: Compliance & Regulatory

Legal authority

Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code Ch. 541
Texas Identity Theft Enforcement and Protection Act, Tex. Bus. & Com. Code § 521.053
Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code § 503.001
OCC Bulletin 2023-17 (Risk-Based Supervisory Guidance for Banking Organizations; Not Law)
FFIEC IT Examination Handbook

Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.

Not legal advice

This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.

Checked against the law it cites

The statutes this template relies on are listed under Legal authority.

Tex. Bus. & Com. Code §§ 541.104-.105 (checked September 19, 2026): "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller. A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data."

Tex. Bus. & Com. Code § 521.053(b)-(c) (checked September 12, 2026): "A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person."

Tex. Bus. & Com. Code § 521.053(h)-(i) (checked September 12, 2026): "If a person is required by this section to notify at one time more than 10,000 persons of a breach of system security, the person shall also notify each consumer reporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices. A person who is required to disclose or provide notification of a breach of system security under this section shall notify the attorney general of that breach as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state."

OCC Bulletin 2023-17 / 88 Fed. Reg. 37920 (checked September 6, 2026): "This guidance is relevant to all banking organizations supervised by the agencies. Supervisory guidance does not have the force and effect of law and does not impose any new requirements on banking organizations."

Draft your Vendor Due Diligence Questionnaire - Texas in the editor

Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.