The questions, in the order they usually come
Roles. Whether you act as a processor or controller for the customer's data, and whether you have a data protection officer or a named privacy contact.
The data processing agreement. Whether you have one, whether it follows Article 28, and whether the customer can use theirs. Attach yours. Reviewers compare it with their template, so know where yours differs and why.
Sub-processors. Who they are, where they are, what they do, and how the customer is told before you change them. A published list with a notice period answers this row for every customer at once.
International transfers. Whether personal data leaves the EU or EEA, to which countries, and under which mechanism: adequacy, standard contractual clauses, or the EU-US framework. Name the mechanism for each sub-processor outside the EU, or state that none is.
Security of processing. The technical and organisational measures: encryption, access control, logging, backups, training. This is the overlap with the security questionnaire, and the same answers serve.
Retention and deletion. How long you keep the data during the contract, what happens at the end, how deletion is confirmed, and how backups are handled. Give durations.
Breach notification. How fast you tell the customer about a personal data breach and with what information; the customer has 72 hours to tell its authority, so it wants your commitment to be well inside that.
Data subject rights. How you help the customer respond to access, correction, deletion and portability requests: the mechanism and the time.
Records and audits. Whether you keep records of processing, whether you have had a privacy impact assessment for the service, and whether the customer can audit you.
Answering as a processor
Write the privacy answers once, with your legal advisor if you have one, and keep them as a unit: they change rarely and they must not drift between customers. The rows that need a decision are the notification time, the deletion timeline and the audit terms; decide them with whoever signs your DPA so the questionnaire and the contract say the same thing.
In Responsemate
The privacy answers live in the knowledge base like every other approved answer, with the DPA and the sub-processor list attached as evidence with review dates, and the questionnaire rows are drafted from them in the customer's words. Responsemate's own privacy answers are on the security page, which is also an example of the shape a reviewer expects.
Questions people ask
Are we a processor or a controller?
If you process personal data on behalf of your customer and under their instructions, you are a processor for that data. For your own employees, your marketing contacts and your own customer records you are a controller. Most SaaS vendors are both, for different data, and the questionnaire asks about the processor role.
Do we need a data protection officer?
Only if the law requires one for your kind of processing. Questionnaires ask; "no, not required, the named privacy contact is X" is a complete answer.