Vendor due diligence for clinics, accountants, and regulated sectors

Short answer: Regulated NZ practices should vet vendors for data handling, breach notification, subprocessors, and NZ-appropriate contracts—not just pick the cheapest form plugin.

Your clients assume you chose tools carefully; diligence is part of professional duty.

Minimum vendor questions

• Where is data stored and who can access it?
• Breach process and timelines for informing you.
• Deletion and export when you leave the tool.
• Uptime and support realistic for your risk tolerance.

Document decisions

Keep short decision notes: why this CRM, what data classes flow into it, review date. Future you—and auditors—will thank you.

Website-specific risks

Live chat, document uploads, and analytics pixels each expand scope; review holistically, not tool-by-tool in isolation.

Frequently asked questions