Legal review of vendor privacy before sharing data

This service is commonly used by businesses that rely on software providers, cloud vendors, agencies, outsourced service providers or other third parties that may access personal information. It is especially relevant where the vendor touches customer data, employee data or sensitive operational information. If your business is comparing suppliers, renewing an existing arrangement or responding to internal concerns about a current vendor, a due diligence review can help clarify where the legal and practical privacy issues sit before more data is shared.

Businesses often run into trouble here when they rely on assumptions instead of checking the scope properly. Common issues include vague statements about how information is stored or disclosed, unclear subcontractor arrangements, weak explanations of retention practices, broad vendor rights to use information, gaps in direct marketing wording and limited transparency around incident response or access controls. How you collect, use and disclose information will shape both the drafting and the advice, so we look for mismatches between the documents and the real vendor role as far as the supplied materials allow.

We review the vendor privacy policy, relevant terms, data handling statements and other supporting materials you provide within the agreed scope. From there, we assess the main legal risk areas, including how the vendor appears to collect, use and share information, what security-related commitments are described, and whether any direct marketing or consent points need attention. You receive a written summary of key findings and practical next steps. If further document negotiation or contract drafting is needed, that can be quoted separately.

Not in an absolute sense. A legal review can identify red flags, missing information and areas where the vendor's documents raise concern, but it cannot give a blanket sign-off on the supplier or promise compliance. The right drafting depends on your actual data flows, including what you collect, why you use it and who receives it, and on what the vendor does in practice behind the documents. This service helps you assess your position and ask better questions before proceeding, rather than replacing technical, procurement or security decision-making.

It helps to provide the vendor privacy policy, terms of service, data processing materials, security summaries, marketing-related wording and any questionnaires or procurement documents already exchanged. If you have particular concerns, such as offshore hosting, customer communications or subcontracting, flag those as well. We then review the material and prepare a written summary of the main privacy risk areas and likely next steps. Depending on the outcome, the next stage may be further questions for the vendor, contract changes, or a broader review of your own privacy position.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Vendor Privacy Due Diligence Review service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.