Data Privacy · Vendor Compliance · Bangladesh

Vendor Data Protection Review in Bangladesh

Check how your Bangladesh vendors collect, store, share and delete the personal data you give them. We review their data processing agreement, follow your data through their systems, and tell you what must change to meet GDPR, UK GDPR and Bangladesh’s data protection law.

Request a Data Protection Review
Call +880 1711-990020

Definition

What Is a Vendor Data Protection Review?

A vendor data protection review is a check of how a supplier handles the personal data you share with it, covering the contract, the purpose, where the data is stored, who can access it, which other companies receive it, and how it is deleted, so you stay compliant with privacy law.

Under the GDPR the vendor is usually your processor and you remain the controller, so its mistakes become your legal problem. Security controls are covered in our vendor cybersecurity assessment; this review covers the privacy and legal side.

GDPR Article 28(3)

What a contract with a data processor must include

  1. InstructionsThe vendor processes data only on your documented instructions.
  2. ConfidentialityStaff who handle the data are bound to confidentiality.
  3. SecurityAppropriate technical and organisational security measures.
  4. Sub-processorsNo new sub-processor without your authorisation, on equal terms.
  5. Individuals' rightsHelp you answer access, correction and deletion requests.
  6. Breaches and DPIAsHelp you with breach notices and impact assessments.
  7. End of contractDelete or return all personal data when the service ends.
  8. AuditsGive you the information and audit access to prove compliance.
Summary based on UK ICO guidance. The UK GDPR uses the same list.

What we review

Eight Areas of a Vendor Data Protection Review

We follow your personal data from the moment the vendor receives it to the day it is deleted, and check each step against the law and your contract.

Data inventory

Which personal data the vendor receives, about whom, and for what purpose.

Lawful basis and notices

Whether each use has a legal basis and is covered by your privacy notice.

Data processing agreement

Every Article 28 clause checked, with redlines for anything missing or weak.

Storage location and transfers

Where the data sits and which safeguards cover each cross-border transfer.

Access and security

Who at the vendor can see the data, and how access is approved and logged.

Retention and deletion

How long data is kept and what proof of deletion the vendor can give.

Sub-processors

The full list of other companies that receive your data, and their terms.

Breaches and individual requests

How fast the vendor tells you about a breach, and how it handles access or deletion requests.

Cross-border transfers

Sending Personal Data to a Vendor in Bangladesh

Most of our clients are outside Bangladesh, so the transfer itself needs a legal basis. We check that the right safeguard is signed and actually works in practice.

Bangladesh does not have an EU adequacy decision, so personal data sent from the EU to a Bangladesh vendor needs a transfer safeguard such as the Standard Contractual Clauses.

Contract redlines

Clauses We Flag in Vendor Data Processing Agreements

Many vendor contracts look complete but leave the vendor free to reuse, keep or pass on your data. These are the wording problems we see and fix.

Vendor DPA: our redline commentsExample clauses
CLAUSE 1The Supplier may use Customer Data to improve and develop its services.
Purpose creep. Your data must be used only for your instructions.
CLAUSE 2The Supplier may appoint sub-processors at its discretion.
No authorisation or notice. You must approve or be able to object.
CLAUSE 3Data will be retained for as long as reasonably necessary.
No deletion date. Ask for a fixed period and a deletion certificate.
CLAUSE 4The Supplier will notify the Customer of a breach as soon as practicable.
Too vague. Set a fixed time, so you can meet the GDPR's 72-hour deadline.
CLAUSE 5Total liability is limited to fees paid in the previous month.
Cap is too low for a data breach. Negotiate a separate data protection cap.

Deliverables

What You Receive

Practical outputs your legal, privacy and procurement teams can use straight away.

Data flow map

A diagram of where your personal data goes, inside and beyond the vendor.

DPA redline

Marked-up contract with the clauses to add or change.

Transfer assessment

The safeguard and risk notes for each cross-border transfer.

Gap register

Every gap with its risk level, owner and deadline.

Review schedule

When to check the vendor again, and what will trigger an early review.

FAQs

Vendor Data Protection: FAQs

Short answers to the questions clients ask before sharing personal data with a Bangladesh vendor.

Need the full vendor risk picture? See our third-party risk assessment.

It is a check of how a supplier handles the personal data you share with it: the contract, the purpose, storage location, access, sub-processors, transfers and deletion. It shows whether the arrangement complies with privacy law and what needs to change.

A cybersecurity assessment tests the vendor’s security controls. A data protection review looks at the legal and privacy side: what data is used, why, under which contract, where it goes and when it is deleted. See our vendor cybersecurity assessment for the security side.

A DPA is the contract between you, as controller, and a vendor that processes personal data for you. Under Article 28 of the GDPR it must cover instructions, confidentiality, security, sub-processors, help with individuals’ rights and breaches, deletion or return of data, and audits.

Yes, but it needs a safeguard. Bangladesh does not have an EU adequacy decision, so transfers usually rely on the EU Standard Contractual Clauses, or the UK IDTA or Addendum for UK data, together with a transfer risk assessment.

Under the GDPR the processor must tell the controller without undue delay, and the controller must notify the regulator within 72 hours of becoming aware, where required. We recommend a fixed notice period, such as 24 to 48 hours, written into the DPA.

Yes. Bangladesh has introduced a personal data protection law that makes the company sharing data responsible for how its processors handle it. Rules and enforcement are still being set up, so check the current position with your legal adviser.

Their data processing agreement, privacy notice, list of sub-processors, data retention policy, breach response plan, and details of where data is stored. We send a short request list at the start.

No. It is a compliance review. Where a finding needs a legal opinion, we flag it so your lawyer can advise.

Before you share personal data

Book a Vendor Data Protection Review

Tell us the vendor, the personal data involved and where your company is based. We will confirm the scope, timeline and fee in writing.

BPO Bangladesh · Suite 610, 5th Floor, Rupayan Shopping Square, Bashundhara R/A, Dhaka 1229 · +880 1711-990020

Get a scoped quoteFor one vendor or your whole vendor list.

Request a Review
Email [email protected]