BPO Vendor Due Diligence Checklist

Choosing an outsourcing partner is a risk decision as well as a cost decision. Use this checklist before you sign. Download the full version at the bottom of this page.

1. Company and financial checks

• Registration documents, who owns the company, and its directors
• Financial health: recent accounts and references from other buyers
• Insurance cover relevant to the work

2. Security: ask for the right evidence

• ISO/IEC 27001: a certification of the vendor's information-security management system, issued by an accredited certification body. Ask for the certificate number, the certifying body and the scope.
• SOC 2: an attestation report issued by an independent CPA firm under AICPA Trust Services Criteria (Type I or Type II). It is not a certificate. Ask for the latest SOC 2 Type II report and read the exceptions it lists. (Source: AICPA SOC suite, as of 5 Nov 2026)

3. Data protection by delivery country

• Philippines: the Data Privacy Act of 2012 (Republic Act No. 10173) is in force and enforced by the National Privacy Commission. (NPC, as of 5 Nov 2026)
• India: the Digital Personal Data Protection Act, 2023 is law, and the DPDP Rules, 2025 were notified on 14 Nov 2025. They take effect in phases: Consent Manager provisions from 13 Nov 2026, and the main duties (notice, consent, security, breach reporting, individuals' rights) from 13 May 2027. (MeitY, as of 5 Nov 2026)
• Pakistan: there is no comprehensive personal-data protection law yet. The Personal Data Protection Bill is still a draft. PECA 2016 covers certain cyber offences but is not a general data-protection law. Your contract terms and the vendor's controls matter more here. (MoITT, as of 5 Nov 2026)
• Data transfers and contract terms depend on your situation. Have your counsel review them.

4. People

Hiring and background checks, staff turnover, training, and supervision ratios.

5. Operations and continuity

Business continuity plan, backup power and connectivity, a tested disaster-recovery plan, and access controls.

6. Contract and SLA points to confirm

Service levels and remedies, data-handling terms, subcontracting, exit and handover, and audit rights. Get legal advice on the contract itself.

7. Score the vendor

Score each section from 1 to 5 and weight security and data protection most heavily.

Get the full checklist (free)