can I have the questionnaire reviewed by a colleague first
Having a colleague review it is usually not a problem
Yes, having a colleague review a questionnaire is usually possible without consequences for the content. This is an internal organisational choice, not a legal hurdle: who looks at it internally does not change what is filled in or submitted. The responsibility for the answers remains with the enterprise, regardless of how many colleagues review it. What is particularly important is which answers you let a colleague review: technical questions about information security belong with a different colleague than questions about annual turnover or number of employees.
What matters in practice is whether the colleague needs access to the entire data file or only to the specific questionnaire. For a questionnaire with technical security questions — for example about the control measures in Annex A of ISO/IEC 27001, or about the ten measures in Article 21(2) of the NIS2 Directive — it is obvious that an IT or compliance colleague reviews it. For a sustainability list according to the VSME basic module of EFRAG it is more likely to be someone who manages the CO2 or personnel figures. The system itself does not assess or advise anything; it only shows which answer comes from the file and which evidence supports it, so that a colleague can review it before it is confirmed.
Where this comes from: who enters the data, not who views it
There is no legal rule that prescribes who may view a questionnaire before it is submitted. The Commercial Register Act 2007 and the CSRD Directive (Directive (EU) 2022/2464) determine which data an enterprise must record and report, not who within the enterprise may review that data. That is an internal matter. However, what is relevant: if the questionnaire contains sensitive information, for example about registered name or internal business processes, the confidentiality button can be used to determine who exactly reviews it.
This answer applies to every type of questionnaire, not only to the cyber questions from your customer, answer it. The full explanation — with the sources, country-specific details and related topics — is on the hub.
This is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.