You probably have an idea about which data your supplier should process. But make sure your supplier can document the data they process. Also if your supplier used sub-suppliers or partners.
With an ISAE 3000 declaration, you can see an exact overview of which data are processed. And then you don’t need to investigate it yourself.