A provider's GDPR page can tell you where to start. The contract and operating procedures need to answer the harder questions: which data the provider processes, who can access it, and what happens when something goes wrong.
Bring the person responsible for data protection and the person running the application into the same review. One can assess the obligations; the other can check whether the proposed process will work.
Check the processor contract against the service
When a provider processes personal data on your behalf, the arrangement needs the binding terms required by Article 28. The EDPB's controller and processor guide sets out what those terms must cover, including instructions, confidentiality, security, and the use of further processors.
Read the service description alongside those terms. Does the scope include backups, monitoring, support, and incident investigation? Check the subprocessor list and the process for notifying changes. Ask for an explanation wherever the contract describes a narrower service than the one you are buying.
Trace support access as well as storage
An EU storage location does not answer every transfer question. Find out whether a separate organisation outside the EEA can access personal data through support, logging, or another service. Where a transfer occurs, check the applicable mechanism and any assessment it requires. The EDPB's international-transfer guide explains the conditions.
Include these access paths in your data-flow map. Ask the provider to confirm locations and access arrangements for the services you will actually use.
Agree on the first incident message
The processor must notify the controller of a personal data breach without undue delay. The controller has a separate duty to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to create a risk to individuals' rights and freedoms. The EDPB's breach guidance distinguishes those duties.
The contract should support a prompt first message even when the investigation is incomplete. Agree on a contact channel, escalation contacts, and follow-up updates. A mailbox that nobody reads over the weekend is a practical gap worth fixing before signing.
Walk through an access or deletion request
Use a test account to find out where its records appear: application storage, search indexes, uploaded files, logs, and downstream systems. Identify who would collect an export or carry out a deletion.
Requests generally require a response within one month. An extension of up to two further months is possible where necessary because of complexity or the number of requests, with notice and reasons in the first month. Rights such as erasure have exceptions; the EDPB's rights guide explains their application.
Document how backups and retention obligations will be handled with your data-protection adviser. Include what happens after a restore, so records already marked for deletion are not quietly returned to active use.
Read the scope of the evidence
Ask which services, locations, and period an audit report covers. Read the exclusions and the controls the customer must operate. Check how the contract provides for compliance information and audits, including inspections; Article 28 addresses these obligations in the GDPR text.
A certification logo does not answer those questions. Nor does a smaller provider automatically provide better access to evidence. Request the documents from every shortlisted provider, including Anchras, and record the questions that remain open before making the decision.