Five years ago, supplier data security questionnaires were largely the preserve of large financial institutions, government departments and healthcare organisations. If you were not in their supply chain, you were unlikely to receive one.

That has changed significantly. The questionnaires have followed a clear pattern of trickling down through supply chains, from regulated enterprise to mid-market, from mid-market to SME supplier. The businesses receiving them today are not fundamentally different from the businesses that were not receiving them three years ago. The businesses sending them have simply extended their requirements further down the chain.

What these questionnaires are actually asking

The content of supplier security questionnaires varies but the majority cover a consistent set of areas. Understanding what is being asked, and why, helps both in preparing answers and in understanding what genuinely needs to be in place.

**Cyber security controls**

Questions about what technical security controls are in place. Firewall configuration, endpoint protection, patch management practices, email security, multi-factor authentication. These questions are assessing whether your business has implemented the basics, roughly equivalent to what Cyber Essentials certification tests.

**Data protection practices**

Questions about how personal data is handled. What data you process, on what legal basis, how it is protected, who has access, how long it is retained and what your breach response process looks like. These questions are assessing UK GDPR compliance.

**Access management**

Questions about how user access is managed. How accounts are provisioned and deprovisioned, how administrator access is controlled, whether multi-factor authentication is in place for remote access and privileged accounts.

**Business continuity**

Questions about resilience. Whether you have a tested backup and recovery process, whether you have a business continuity plan, what your recovery time objectives are.

**Third-party risk**

Questions about your own supply chain. What suppliers have access to your systems or data, what due diligence you have conducted on them, whether Data Processing Agreements are in place.

**Certifications and evidence**

Many questionnaires now ask specifically for Cyber Essentials certification, ISO 27001 certification, or other third-party evidence of security practices. The move from self-attestation to third-party evidence is one of the most significant shifts in supplier security requirements over the past two years.

Why this is happening

The organisations sending these questionnaires have learned, often from painful experience, that their supply chain represents a significant attack surface. A large enterprise with sophisticated security controls can still be compromised through a smaller, less well-protected supplier that has privileged access to their systems or data.

The regulatory environment reinforces this. UK GDPR places explicit obligations on data controllers regarding the security practices of their processors. Enterprise legal and compliance teams are increasingly requiring evidence of supplier security as a contractual and regulatory necessity rather than a nice-to-have.

What happens if you cannot answer

In the short term, the questionnaire gets escalated within the client’s procurement or security team. You may be given an opportunity to remediate specific gaps. In some cases there is flexibility on timeline.

In the longer term, businesses that consistently cannot answer these questionnaires satisfactorily are quietly removed from preferred supplier lists or excluded from tender processes before they reach the questionnaire stage. This happens without fanfare, you simply stop being considered.

How to prepare

The good news is that the controls being asked about are not exotic or expensive. They are broadly equivalent to what Cyber Essentials certification tests, five core technical controls that most businesses are closer to implementing than they realise.

The preparation has three elements. First, understand what your current position actually is, not what you assume it is, but what an honest assessment reveals. Second, close the gaps that matter most, prioritised by what is most commonly asked for rather than what is most technically complex. Third, document what you have in place so you can evidence it clearly when asked.

Northstar’s IT and Cyber Risk Review is designed specifically to give you an honest picture of where you stand against these requirements, and what proportionate action looks like for a business of your size.

Eight years after GDPR came into force, most UK SMEs are still operating with significant data protection gaps. Not because they don’t care, but because the guidance available is either too legal or too vague to act on.

Here’s a plain-English commercial view.

GDPR came into force in May 2018. Eight years on, the majority of UK SMEs are still operating with significant data protection gaps.

Not because they are reckless or indifferent. But because the guidance available is either written by lawyers for lawyers, or so high-level as to be practically useless. “You must have a lawful basis for processing personal data” is accurate. It is also not actionable without a great deal more context.

This post attempts a more useful approach: a plain-English, commercially oriented view of what GDPR actually requires of a UK SME, where the most common gaps are, and what proportionate action looks like.

What GDPR actually requires – the commercial essentials

The UK GDPR (which retained the EU regulation post-Brexit with minor modifications) applies to any organisation that processes personal data about individuals in the UK. For virtually every SME, that means it applies to you.

The core obligations, in practical terms:

**Know what data you hold** – you must be able to identify what personal data your organisation holds, where it is stored, what it is used for, who has access to it, and how long you keep it. This is typically documented in a Record of Processing Activities (ROPA). Most SMEs do not have one.

**Have a lawful basis for processing** – for each category of personal data you process, there must be a legitimate legal basis. For most SME data processing, this is either a contractual necessity (you need the data to fulfil a contract), a legal obligation (you are required by law to hold it), or legitimate interests (you have a genuine business reason that is proportionate and not overridden by the individual’s rights).

**Be transparent** – individuals whose data you hold must be told what you are doing with it. This is typically communicated through a Privacy Notice on your website and in your contracts and onboarding materials.

**Protect the data** – appropriate technical and organisational measures must be in place to protect personal data from loss, theft or unauthorised access. This overlaps significantly with cyber security – which is why data protection and cyber risk are best addressed together.

**Respect individual rights** – individuals have rights over their personal data, including the right to access it, correct it, and in certain circumstances, have it deleted. You must have a process for handling these requests.

**Report breaches** – if personal data is lost, stolen or accessed without authorisation, and the breach is likely to result in risk to individuals, you must report it to the ICO within 72 hours of becoming aware of it.

Where most SMEs have gaps

In my experience, the most common data protection gaps in UK SMEs fall into five areas:

**No data register** – the organisation does not have a clear picture of what personal data it holds, where it lives, or who can access it. This makes it impossible to respond meaningfully to a subject access request, demonstrate compliance to a client, or assess the impact of a breach.

**Inadequate privacy notices** – the website has a Privacy Policy (often copied from a template) that does not accurately reflect actual data processing practices. Template policies are better than nothing, but they create a gap between what the business says it does and what it actually does.

**Third-party risk not managed** – personal data shared with suppliers, cloud platforms, and SaaS tools without adequate contractual protections or due diligence.

GDPR requires that when you share personal data with a third party processor, there is a Data Processing Agreement in place. Most SMEs do not have these.

**Retention periods not enforced** – personal data is kept indefinitely because nobody has defined retention periods or built a process for deleting data when it is no longer needed. Old customer records, historic employee data, and archived email are common examples.

**Breach response not planned** – the 72-hour reporting requirement is one of the most commercially consequential aspects of GDPR, and most SMEs do not have a process for identifying, assessing and reporting breaches within that window.

What proportionate compliance looks like

GDPR compliance for a 20 to 100-person SME does not require a dedicated data protection officer or an expensive consultancy programme. It requires:

– A data register that accurately reflects what personal data you hold and why

– A Privacy Notice that reflects your actual practices

– Data Processing Agreements with key suppliers who process personal data on your behalf

– Defined retention periods and a process for enforcing them

– A basic breach response process that ensures incidents are identified, assessed and reported appropriately

– Staff awareness – the people handling personal data understand the basics of what is and is not acceptable

None of this is particularly complex. But it does require someone to own it, and it does need to be kept current as the business changes.

The commercial imperative is real. Enterprise clients increasingly include data protection requirements in supplier questionnaires. Cyber insurers ask about GDPR compliance as part of underwriting. And the ICO, while primarily focused on larger organisations, has demonstrated a willingness to act against SMEs where breaches result from obvious neglect. Getting this right is not a legal exercise. It is a commercial one.