When you take on a supplier who will touch your data - a bookkeeper, a booking platform, an outsourced payroll, a marketing agency - their weaknesses become yours. Most small businesses know this and freeze, imagining a fifty-page assessment they are not qualified to judge. You do not need that. You need three questions, asked in plain English, and a supplier's willingness to answer them tells you nearly as much as the answers do.

The first: what do you actually hold about us and our customers? A supplier who can answer clearly, and who holds only what they need, is already ahead of one who has never thought about it. Vagueness here - ‘oh, everything, just in case’ - is itself the finding.

The second: who else can see it? This flushes out the subcontractors, the offshore support team, the third-party tools they quietly rely on. Data you handed to one company may be sitting with three others you have never heard of, and you are entitled to know that before you sign, not after a breach.

The third, and the one that separates the grown-ups: how fast will you tell us if something goes wrong? Under data protection law you can have very little time to report a breach, and you cannot report what a supplier sits on for a fortnight. A supplier who commits to telling you promptly, in writing, is one you can plan around. Ask the three, keep the answers, and revisit them when the contract renews.