Checklist · Privacy · Vendors

Checklist: Privacy and Data Vendor Contract Review for Regulated Businesses

Every vendor that touches personal information becomes part of your privacy program. What to review before you sign.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

Every vendor that touches your customers’ or employees’ data becomes part of your privacy program, whether or not the contract says so. When a vendor mishandles personal information, regulators, plaintiffs, and customers look first to the business that chose the vendor. Illinois does not have a comprehensive consumer privacy statute, but it has specific laws that reach vendor relationships directly, and businesses that serve customers in other states, handle financial data, or use AI in employment decisions face additional contract requirements. This checklist sets out what to review before signing a vendor contract that involves personal information.

Scope the data before you read the contract

• Identify the personal information involved. List the categories: names and contact details, account numbers, government identifiers, health information, biometric identifiers, precise location, and information about children.
• Identify whose data it is. Customers, patients, employees, applicants, and website visitors can each trigger different rules.
• Map the flow. Record what the vendor receives, where it is stored, who can access it, and whether it leaves the United States.
• Confirm the purpose. The contract should limit the vendor to the service you are buying. Anything broader is a separate decision.
• Identify the laws that apply. The answer depends on the data and the people, not on where the vendor is located.
• Classify the risk. Rank the vendor as low, moderate, or high risk based on the data, the volume, and the access, and scale the review to match.

Core contract terms

• Use limitation. The vendor may process personal information only to provide the services and only on your documented instructions.
• No sale or secondary use. Prohibit selling, sharing for advertising, or using the data to build or train the vendor’s own products unless you have decided to permit it and have the right to do so.
• Confidentiality of personnel. Require the vendor to bind its employees and contractors to confidentiality.
• Security. Require reasonable security measures appropriate to the data. For personal information of Illinois residents, a contract for disclosure must include a provision requiring the recipient to implement and maintain reasonable security measures (815 ILCS 530/45(b)).
• Subprocessors. Require notice of subprocessors, the right to object, and flow-down of the same obligations.
• Breach notice. Require prompt notice of any security incident involving your data. Illinois law requires a data collector that maintains data it does not own to notify the owner immediately following discovery of a breach (815 ILCS 530/10(b)). Set a specific contractual period, often 24 to 72 hours, and require the information you will need to notify individuals and regulators.
• Cooperation. Require help with individual rights requests, regulatory inquiries, and investigations.
• Audit and evidence. Reserve the right to receive security reports, questionnaires, and certifications, and to audit when justified.
• Return and deletion. Require return or secure deletion of the data at the end of the contract, with written certification. Illinois requires disposal of personal information in a manner that renders it unreadable, unusable, and undecipherable (815 ILCS 530/40).
• Liability. Check whether the limitation of liability carves out data breaches and confidentiality, and whether indemnity and insurance match the risk.

Illinois-specific checks

• Biometric identifiers. If the vendor provides timeclocks, identity verification, or any system that uses fingerprints, face geometry, or voiceprints, the Biometric Information Privacy Act applies. Before collection, the business must have a publicly available retention and destruction policy and obtain informed written consent, and it may not sell or profit from biometric data or disclose it without consent (740 ILCS 14/15). The vendor contract should confirm that the vendor will not use the data for any other purpose, will delete it on schedule, and will cooperate with consent and retention obligations.
• AI in employment decisions. If the vendor provides tools that influence recruiting, hiring, promotion, discipline, or discharge, the Illinois Human Rights Act, as amended effective January 1, 2026, prohibits employers from using artificial intelligence in a way that has a discriminatory effect and requires notice to employees when AI is used for those decisions (775 ILCS 5/2-102(L)). Ask the vendor what the tool does, what data it uses, and what bias testing it has performed, and require cooperation with notices and investigations.
• Health information. If the vendor handles protected health information for a covered entity, a business associate agreement is required in addition to these terms (45 C.F.R. 164.504(e)).

Sector and out-of-state requirements

• Financial information. Non-bank financial institutions subject to the FTC Safeguards Rule must take reasonable steps to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess service providers based on risk (16 C.F.R. 314.4(f)).
• Consumers in other states. Comprehensive privacy laws in other states require specific contract terms with service providers and processors. California, for example, requires a written contract that limits a service provider’s use of personal information and includes specified terms (Cal. Civ. Code 1798.100(d)). If you have customers in those states and meet their thresholds, use a data processing addendum that satisfies them.
• Children’s information. Websites and online services directed to children under 13 must meet federal requirements for collection and security of children’s personal information (16 C.F.R. Part 312), and vendors that collect it on your behalf should be bound accordingly.
• Unfair or deceptive practices. The Federal Trade Commission treats failures to protect personal information, including through inadequate vendor oversight, as potential unfair or deceptive practices (15 U.S.C. 45). Your privacy notice should accurately describe how vendors use the data.

Questions to ask the vendor in writing

• What data do you collect from us, and what do you collect directly from our customers or employees? Tracking pixels, software development kits, and support tools often collect more than the core service needs.
• Where is the data stored and accessed, and by whom? Ask for the list of subprocessors and the countries involved.
• Do you use our data, or data derived from it, to train models or improve other products? Get the answer in the contract, not only in a sales conversation.
• How long do you keep the data after the contract ends, including backups? Ask for the deletion timeline and the certification you will receive.
• What happened in your last security incident? A vendor that has handled an incident well and can explain its response is often a better risk than one that claims it has never had one.

Before signature

• Match the contract to your privacy notice. If your notice says you do not sell data or share it for advertising, the vendor contract must say the same.
• Obtain security evidence. Review a recent SOC 2 report or equivalent, and record any exceptions and how the vendor addressed them.
• Confirm the order of precedence. Make sure the data processing addendum controls over the vendor’s online terms and any later click-through updates.
• Record the decision. Note who approved the vendor, the risk level, and any accepted exceptions.

After signature

• Add the contract to your vendor inventory and renewal calendar. Include the date for the next security review.
• Limit access. Give the vendor only the access the service requires, and remove it promptly when the relationship ends.
• Reassess on a schedule. Review high-risk vendors at least annually and whenever the service or the vendor’s ownership changes.
• Test the exit. Confirm, before you need it, how data will be returned and deleted.
• Watch for ownership changes. An acquisition can change where data goes and who can reach it. Require notice of a change of control and the right to terminate if the new owner cannot meet the contract.

A vendor contract cannot make an unsafe vendor safe, but a well-reviewed contract, backed by evidence and followed through after signature, is what shows that a business took its privacy obligations seriously.