You have received a compliance questionnaire
An insurance questionnaire, a supplier questionnaire, a certification file. Here is who is entitled to ask you for it, and what the text actually requires of you.
What is happening to you
A customer, an insurer, a bank or a contracting entity sends you a questionnaire and a deadline. You have to answer, and your answer commits you.
Why they are entitled to ask you
| Text | Article | Who must prove | To whom | Size threshold |
|---|---|---|---|---|
| Reglement general sur la protection des donnees | 28, paragraphe 3, point h) | le sous-traitant | le responsable du traitement, c'est-a-dire le client donneur d'ordre, un autre auditeur mandate par lui | none |
| Reglement general sur la protection des donnees | 28, paragraphe 1 | le sous-traitant, indirectement | le responsable du traitement | none |
| Reglement general sur la protection des donnees | 32, paragraphe 1, point d) | le responsable du traitement ET le sous-traitant | non nomme | none |
| Reglement general sur la protection des donnees | 5, paragraphe 2 | le responsable du traitement | aucun destinataire nomme | none |
| Reglement general sur la protection des donnees | 24, paragraphe 1 | le responsable du traitement | aucun destinataire nomme | none |
| Reglement delegue completant DORA sur la politique relative aux services TIC | 6, paragraphe 1 | le prestataire tiers de services TIC, c'est-a-dire NOTRE PROSPECT | l'entite financiere, des tiers designes a cet effet, les autorites competentes | aucun seuil de taille cote prestataire ; champ sectoriel cot |
| Reglement delegue completant DORA sur la politique relative aux services TIC | 6, paragraphe 3 | le prestataire tiers de services TIC | l'entite financiere | aucun seuil de taille cote prestataire ; champ sectoriel cot |
| Reglement delegue completant DORA sur la politique relative aux services TIC | 8, paragraphe 2 | le prestataire | l'entite financiere | aucun seuil de taille cote prestataire ; champ sectoriel cot |
| Directive NIS2 | 32, paragraphe 2, troisieme alinea | l'entite controlee | l'autorite competente | Entite Essentielle : 250 salaries OU CA > 50 M EUR et bilan |
| Directive NIS2 | 32, paragraphe 2, point g) | l'entite | l'autorite competente | Entite Essentielle : 250 salaries OU CA > 50 M EUR et bilan |
What counts in your answer
European law does not ask for a declaration, it asks you to demonstrate. The difference fits into a single sentence: a ticked box is an assertion, a measured fact is evidence. That is the difference the third party will hold you to on the day it checks.
This page quotes official texts. Every quotation is reproduced word for word and links back to its source. It does not constitute legal advice and is no substitute for reading the text that applies to your own situation. European Union texts quoted on this page are reused under Decision 2011/833/EU, licensed under the Creative Commons Attribution 4.0 International licence. © European Union, 1998-2026. Quotations are reproduced without modification; only their formatting differs from the original. Source: EUR-Lex (eur-lex.europa.eu). Only European Union legislation printed in the paper edition of the Official Journal of the European Union is deemed authentic.