# NoticeKit Self-Audit Worksheet

Use this worksheet before adding, replacing, or materially changing a subprocessor. It is built for sharing with counsel, a fractional DPO, or the operator who owns the customer notice.

NoticeKit provides operational templates and workflow checklists. It does not provide legal advice, contract interpretation, or an attorney-client relationship. Have qualified counsel review your agreements, notices, subprocessors, objection process, and customer communications before relying on them.

## Vendor Change

| Field | Notes |
| --- | --- |
| Vendor name |  |
| Vendor website or source link |  |
| Internal service owner |  |
| Product area or workflow affected |  |
| New, replacement, region change, or purpose change |  |
| Planned notice date |  |
| Planned effective date |  |
| Review owner |  |

## Readiness Score

Check each item that is already true. Count checked items for a score out of 10.

| Ready? | Item | Notes for counsel or review owner |
| --- | --- | --- |
| [ ] | Public subprocessor list exists and is reachable. |  |
| [ ] | Vendor facts are complete: name, purpose, service owner, processing region, and source links. |  |
| [ ] | Data categories are clear in plain language. |  |
| [ ] | Affected customers are segmented by customer, DPA version, region, plan, or contractual obligation. |  |
| [ ] | Notice window or objection period is mapped from the relevant agreement language. |  |
| [ ] | Planned dates leave enough time for the applicable notice window. |  |
| [ ] | Customer notice copy is drafted with vendor purpose, data, dates, objection path, and contact route. |  |
| [ ] | Evidence log is ready for sent time, recipients, proof links, objections, and outcome. |  |
| [ ] | One accountable owner is assigned for send, follow-up, objections, and evidence closeout. |  |
| [ ] | Final review path exists through counsel, DPO, or the accountable operator. |  |

Score: `__/10`

## Score Meaning

| Score | State | Operating guidance |
| --- | --- | --- |
| 0-4 | High-risk gap | Do not send from memory. Build the vendor facts, affected customer list, notice timing, owner, and evidence record first. |
| 5-7 | Needs cleanup | The workflow is close, but missing fields can create deadline confusion, customer questions, or weak proof later. |
| 8-10 | Review-ready | The operational packet is ready for final attorney, DPO, or accountable operator review before sending. |

## Priority Fixes

List the top missing items before the notice is sent.

| Priority | Missing item | Owner | Due date | Status |
| --- | --- | --- | --- | --- |
| 1 |  |  |  |  |
| 2 |  |  |  |  |
| 3 |  |  |  |  |
| 4 |  |  |  |  |

## Customer Segments

| Segment | Customers or accounts | Agreement or DPA version | Notice window | Contact path | Notes |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |
|  |  |  |  |  |  |
|  |  |  |  |  |  |

## Evidence Plan

| Evidence item | Where it will be saved | Owner | Complete? |
| --- | --- | --- | --- |
| Final vendor facts |  |  | [ ] |
| Final notice copy |  |  | [ ] |
| Recipient list or segment export |  |  | [ ] |
| Send proof or campaign log |  |  | [ ] |
| Public list update proof |  |  | [ ] |
| Objection deadline record |  |  | [ ] |
| Customer objections and responses |  |  | [ ] |
| Closeout note |  |  | [ ] |

## Review Questions

- Which contracts or DPA versions decide whether notice is required?
- Is the vendor a new subprocessor, a replacement, a region change, or a purpose change?
- Which customer accounts need direct notice, and which can rely on the public list update?
- What is the earliest defensible effective date after the applicable notice window?
- Who receives and answers objections?
- What proof will be preserved if a customer asks later?