Vendor assessments for privacy programmes — risk triage, evidence standards, contract alignment, ongoing monitoring and defensible third-party oversight.