You're right! Those are all critically important questions to ask! It's just possible that they might not be completely exhaustive, though. Do they take reason

You're right! Those are all critically important questions to ask! It's just possible that they might not be completely exhaustive, though. Do they take reasonable measures to detect and inform me of a breach? Do they take reasonable measures to ensure it's me requesting data being deleted? Can they provide the same data about all Data Processors they make use of? It's possible that the answers to this might not be easily and readily answered in every single potential case one might encounter when dealing with specialist vendors. You're completely right to spell out those questions. It's just possible that there may be more to GDPR compliance - and certainty - than that in some cases.