How do I complete a customer's privacy questionnaire?

The questionnaire asks about what you already record in your processing register

A privacy questionnaire from a customer usually covers the same topics as the processing register: which personal data are processed, for what purpose, how long they are retained, who has access to them, and whether a processor is involved. Anyone who already has that register in order can answer most questions directly from it. Questions about security — encryption, access controls, backups — fall under the technical and organisational measures that the customer wants to see before sharing data with you.

Part of the questionnaire often concerns the organisation around it: is a data protection officer appointed, is there a procedure for a data breach, and who is it reported to. The latter varies by country: in the Netherlands it is the Dutch Data Protection Authority, in Germany the supervisory authority of the state where the establishment is located. The obligation to appoint a data protection officer yourself has no threshold based on staff numbers in the Netherlands — this follows from Article 37 GDPR — whereas Germany uses a number of employees as a limit under § 38 BDSG. For a reader active in multiple countries, it is therefore important to check per establishment which level applies, rather than giving one answer for the entire organisation.

Justification: the accountability obligation of Article 5 GDPR

That a customer asks this kind of questions and that you can answer them follows from the accountability obligation of Article 5 GDPR: an organisation must not only comply with the principles of the regulation, but also be able to demonstrate this. A questionnaire is essentially the customer placing part of his own accountability obligation on you. The Dutch Data Protection Authority publishes general guidance on these principles, without this resulting in a format for a customer questionnaire — each customer fills this in themselves.