Breach of contract
If you say yes to something you don't meet, it becomes a contractual obligation. When an incident happens, you are left with a commitment you could never keep.
Emergency · Customer requirements
Your customer demands answers on security and GDPR
A due diligence questionnaire with 120 questions and a two-week deadline is not a crisis in the firefighting sense – but it decides whether you win the deal. And it reveals exactly where your gaps are.
Urgent Book a meeting or email us – we normally reply within one working day.
Received a questionnaire you don't know how to answer? Send it to us. We go through the questions, what you can actually answer and what needs fixing before you reply.
What to expect
The questions come up in the same order
| Area | What the customer wants to know | What you need to have |
|---|---|---|
| Management system | Do you have ISO 27001 or equivalent? | An honest answer, and a plan if the answer is no |
| Personal data | Data processing agreements, sub-processors, storage location, transfers | Agreement template, list of sub-processors, records of processing |
| Incidents | How quickly will you inform us? | A procedure with timescales you can keep to |
| Access | Who can access our data? Is it logged? | Access model, two-factor authentication, logging |
| Operations and continuity | Backups, restore tests, availability | Test records – not just a backup routine |
| AI | Is our data used for AI training? | A clear policy and an answer per service |
| Exit | Deletion and return of data | Deletion procedure and certificate |
How to answer
Truthful, concrete and with a plan
- Answer truthfully, even when the answer is no. Claiming a certification you don't have is a breach of contract, and it is almost always discovered in an audit or during an incident.
- Answer the question, not the whole topic. A short, accurate answer is stronger than two pages of self-praise.
- Be specific with numbers. "We notify within 24 hours" is better than "we notify promptly".
- Describe gaps with a plan. "Not in place today, being introduced in Q2, X is responsible" is an answer a buyer can accept. Silence or "not applicable" is not.
- Don't promise more than you can deliver. Information rights, audits and remediation times that you can't meet become problems in the contract, not advantages in the deal.
- Have one person who owns the answer. Questionnaires are best answered by someone who understands both the technology and the contract – often that is two people, but one of them should hold the pen.
The AI question comes up more and more often. Buyers want to know whether their data is used to train models, whether you use AI in your delivery and, if so, how it is governed. If you have no answer today, it is time to write a short AI policy – otherwise the answer becomes "don't know", and that costs deals. Read more about AI, the AI Act and implementation.
What a wrong answer costs
Three risks of a careless answer
Lost deal
Vague answers stall procurements. Clear answers with a plan usually get through – even when the answer is no today.
The audit afterwards
The requirements you have answered carry over into the contract and are reviewed afterwards. What was a simple questionnaire question becomes an action item with a deadline.
Questions and answers
What we get asked
We don't have ISO 27001 – will we lose the deal?
Not necessarily. Many buyers accept a structured answer with equivalent measures and a timeline. What sinks the deal is silence or unfounded claims.
Do we need a data protection officer?
It depends on your business. Core activities that involve systematic and extensive monitoring, or large-scale processing of sensitive data, require one. The question often comes up in the questionnaire.
How quickly do we need to be able to respond to a customer incident?
Whatever you agree. Common commitments are 24 hours for notification and 72 hours for an initial analysis. Start from what your organisation can manage in practice.
Can you fill in the questionnaire for us?
We go through it with you, pull together the supporting documents and write the answers together with you. You are the sender and should recognise every answer.
The customer is requesting an audit of us – what do we do?
An audit is usually a conversation and a document review, not a technical scan. We prepare you for the questions and make sure the evidence is ready to hand.
Sources and further reading
Information from authorities changes. Always check the current rules and deadlines with the responsible authority, and take legal advice for legal assessments.
More urgent situations
Other situations we step into
Urgent
Send us the questionnaire
We go through the questions and tell you what you can answer today and what needs to be done first. Half a day is often enough to get there.
Urgent Book a meeting or email us – we normally reply within one working day.