Third-party agreements

You’re only as strong as your weakest link.

And most companies are blissfully unaware of their weakest link when it comes to compliance with new and forthcoming privacy regulations.

This hidden danger? Third-party agreements. Truth is, they can make or break your privacy rights implementation.

Third-party vendors are fast becoming the fashion of the day. The General Data Protection Regulation (GDPR) refers to them as processors. Under the California Consumer Privacy Act (CCPA), they include true third party services, as well as service providers.

Outsourcing specialized or less intensive tasks (think technology, marketing, and IT) to experienced outside resources seems like a no-brainer. In fact, it’s proven more efficient and cost-beneficial for most companies that use it.

Because of the increasing demand for third-party vendors, the risks they bring to the table also escalate dramatically. And the responsibility for managing that liability falls fully on the company to which the third-party vendor is contracted.

In other words, you.

Paying attention to what your third-party vendors are sending – and what those third parties are doing with that data – isn’t just a suggested best practice anymore. Regulatory oversight has expanded to make monitoring sensitive data and processes of third parties critical to a company’s operational success.

If you’re a business that doesn’t have vendor evaluation and monitoring processes in place, you’re not alone. Even if you have created these elements, chances are they’re completed and managed on Excel spreadsheets. Worse, you’re probably using a one-size-fits-all approach for analyzing every vendor.

This is a huge red flag.

Not all vendors are the same. A small consulting firm won’t pose the same risks as a large IT database company. Evaluating both of these vendors on the same scale, with the same criteria, is inefficient and ineffective. It’s essential to customize third-party evaluations based on each company’s size.

Proper third-party agreements protect your company from reputational damage and inadvertently violating laws. Because third-party agreements are an essential part of regulatory compliance and can’t be overlooked, all companies should follow a complete privacy checklist to execute them consistently and accurately.

#1 – Nail Down your Vendor List

Sure, you can probably reference a list of vendors, suppliers, distributors and contractors with whom you do business. But under most regulatory guidance, the definition of a third-party vendor is more nuanced than just a simple list.

Many companies don’t understand that it covers any business arrangement between an organization and another entity, by contract or otherwise.

Under this definition, a third-party agreement includes undocumented, verbal, and hand-shake contracts. These could have been established recently or many years ago by someone who doesn’t work at your company any longer. It doesn’t matter. These contract manufacturers, brokers, agents, and resellers all count as vendors and must be a part of your evaluation of third-party agreements.

To take it a step further, some third parties actually outsource some of their own projects to additional resources. If this comes as a shock, don’t worry. It’s standard practice for vendors to do this without the consent or knowledge of the company they’re working for. However, it’s an essential piece of managing third-party agreements.

Point is, you probably have more third-party agreements than you thought. Nailing down your vendor list – including their own subcontractors – is an essential first step for privacy compliance.

#2 – Review and Update Contracts

Cybersecurity tips for small businessesThe next step on the checklist is reviewing and updating your third-party agreements. You’ll have to read through each contract to make sure it adheres to best practices for cybersecurity, data security, and privacy rights. Doubtless you’ll have to update the verbiage in these contracts to reflect privacy standards and clearly lay out duties for each entity to follow.

In order to maintain a clear definition of responsibility for data, you must follow a process to make sure all your vendors are compliant.

The first step in this process is creating and updating an evergreen inventory of security and privacy updates and requirements. You can then use this database to perform a comparable scan of each of your vendor contracts. You’ll want to hone in on specific contract terms and data processing agreements (DPAs) within contracts.

If you’re wondering if your work completed under the GDPR requirements applies for the CCPA, it doesn’t. There are specific requirements for each regulation, so you’ll need separate inventories supporting each standard.

Once you’ve extracted the outdated language from each vendor contract, it’s time to update it with the correct text. Traditionally, this has been the responsibility of the legal team and focused on data security topics. Now the privacy team also needs to have a say because of the privacy risks and stipulations so prevalent in legislation. Individual rights is an especially important part of this, with amendments limiting the use of data only to a specific purpose. Third parties must agree to honor these individual rights requests on your company’s behalf.

If the privacy team doesn’t lay out how and where data should be managed and stored, the security team can’t protect it. Because of this, all new contract language should be pre-written and pre-approved by the legal, security, and privacy teams.

Most importantly, all companies should have an established method for alerting stakeholders when vendors are subject to breaches or regulatory enforcement. The key to reviewing existing third-party agreements is to pinpoint high risk vendor relationships. When you’ve identified these organizations, you can put extra care around monitoring and preventing risks. This will ensure vendor accountability and compliance across the board.

#3 – Create a Third-Party Risk Management Process

Top 5 To Dos to Make Your Digital Strategy Privacy-FriendlyThe final task on your privacy checklist for evaluating third-party agreements is planning for the future. It’s not enough to ensure your existing vendors are up-to-snuff. You must also create a bulletproof plan for assessing, onboarding, and monitoring vendors you’ll add to your roster in the time ahead.

First, get your team on the same page. This means organizing cross-functional stakeholders from procurement, IT, finance and executives to whom the vendors will report – and privacy officers, of course – to help perform and review new third-party agreements. Next, identify the critical risk categories on which you’ll assess new third parties: strategic, reputational, operational, financial, compliance, security, and/or fraud.

Remember, you also have to make sure appropriate questions are asked to organizations based on their sizes. A simple way to determine evaluation criteria and scoring is through third-party questionnaires. These tools are lifesavers when it comes to evaluating vendors for compliance, security, and other risk factors. Non-profit privacy organizations offer high-quality questionnaires to their members. In addition, any third-party risk management software will normally include these questionnaires for free as a part of a subscription cost.

You may be surprised to learn the most important part of these evaluations is not the completion of them by the vendors in question. It’s critical the team assigned to review these questionnaires – and accept or deny the vendor – actually completes its responsibility, and does it in a timely manner. This cross-departmental group should weigh the scores based on risk impact so vendors can be categorized and prioritized in tiers.

The steps of this third-party risk management plan should be written down and kept on hand by anyone who deals with onboarding new vendors at your company. It should be followed to the letter to ensure all third-party agreements meet company and regulatory standards. And of course, ongoing training is essential. New and existing employees should complete rigorous training on the new third-party risk management process.

Conclusion: Get a Handle on Your Third-Party Agreements

Today’s consumers hold more power than ever before. If there’s an issue with how their data is being managed or used, they’re not going to point the finger at the third-party vendor responsible for the misdemeanor. They’re going to fully blame you – the vendor’s employer.

If you don’t want to get in trouble for something you didn’t do, completing due diligence with your third-party agreements is crucial.

The good news is, risk management software can help you complete this privacy checklist for evaluating third-party agreements in the least amount of time, effort and expense. It allows you to ditch the Excel spreadsheets and dusty digital files. Instead, you’ll be able to utilize a cost-effective, intuitive system that’s applicable to each new vendor.

Hiring a Fractional Privacy Officer (FPO) can also give you a leg up. This individual is adept at creating the review process, managing it from end-to-end, analyzing the assessments, and making it right inside the organization. If you’re interested in seeing how an FPO can exponentially benefit your vendor management process, we’ve got a team of experts who are well-versed in this high-risk area.

Reach out today to schedule a free consultation!


Schedule a free consult!

5 simple steps to CCPA compliance for small business owners.Running a small business can be stressful. Trust me, when I started Red Clover Advisors, I felt overwhelmed by day-to-day operational challenges, building our client base, and ensuring that we were providing top-notch advice and service. Regardless of your industry, being a small business owner means you wear a lot of hats and there are certain areas in which you just don’t have expertise.

Perhaps the CCPA regulations that take effect on January 1, 2020 are one of those items that have piled onto your stress list. Don’t worry! Here are five simple steps to CCPA compliance success for small business owners that I think will really help you navigate the process.

  1. Data is king. If you do not know what customer data you have or understand its implications, it is nearly impossible to comply with the CCPA regulations. The key here is that under the CCPA, data you collect qualifies as personal information. You should start the data mapping process now, if you have not already. Here are some questions to consider when you undergo data mapping:
    • Where do you host your data (including with any third parties)?
    • For what purpose is the data you collect used?
    • Do you collect and sell data on children?
  1. Notify, notify, notify. You can no longer tell a customer once that you are collecting their information. Under the CCPA, you must provide four different notices and update them appropriately. These include, notice of collection of personal information, customer opt-out rights, financial incentive notice, and your business’ privacy policy. While the CCPA regulations may sound like legal jargon to you, it is important that your notices are consumer friendly. Here are some questions to consider when creating or reviewing your notices:
    • Are your notices easy for anyone to understand?
    • Do the notices detail the data you collect such as the sources of information or categories of personal information collected?
    • Do they provide information regarding what your business plans to do with the information collected?
    • Are they designed to grab a customer’s attention? What about individuals with disabilities?
    • Do you do business in another country or with those who speak a language other than English? If so, is each notice available in that language?
  1. Consumer-Centric. You need to have a plan for individual’s rights, which includes being accessible for consumer requests, verification of data, and opt-out options. Under the CCPA, you must explain what you plan to do with the data you collect and provide two ways for customers to contact you regarding said data. Here are some questions to consider when developing your plan:
    • Do you have methods for contact in place? For nearly all businesses, one of these methods must be a toll-free phone number; is it set up? Many businesses also opt for an electronic method; is this right for your business?
    • Do you have a system to ensure timely responses to consumer requests? This can be hard when you are juggling so many things, but it is very important to be aware of these time constraints and abide by them. Did you know that the CCPA regulations state you have to acknowledge most consumer requests within 10 days? And, that the data verification process has to be complete within 45 days?
    • Does your team know how to verify consumer information or what to do in cases that you cannot verify a consumer?
    • Do you have an opt-out policy and process in place? And, is it in the CCPA-approved format?
  1. Train your team.all know that customer service is important and would hate for this to happen, this training goes beyond getting a positive or negative review on social media. Under the CCPA regulations there are new requirements about documentation that anyone who handles consumer requests and data need to be aware of and have proper training regarding the specifics. Here are some questions to consider when creating a training manual:
    • Do your employees know they must keep a record the customer requests that your business is receiving?
    • Do they know these records must be maintained in a log or ticket format?>
    • Do they know that the information maintained in these records cannot be used for any other business purpose?
  1. Rinse and repeat. Once you have a plan in place and have mapped your data, it is important to keep in mind that this is not a one-time thing. Being responsible for consumer data and staying up to date on state and national regulations is the new norm, not something you can set up once and forget about. Here are some questions to consider as you look ahead:
    • How will you integrate the plan for new consumers and their data?
    • How will you keep up with adjustments to the regulations?
    • How will compliance be maintained on an ongoing basis?

We hope this was a helpful resource. But, if you still have questions, please schedule a free call with us. Red Clover Advisors would love to help you navigate this process and make your life a little less stressful.

On October 10, 2019 the California Attorney General released a document of Proposed Regulations for the California Consumer Privacy Act

Learn about the changes GDPR has brought
Photo by April Pethybridge on Unsplash

The privacy world is recognizing a big birthday this year.

Europe’s General Data Protection Regulation (GDPR) officially hit its year-one milestone on May 25, 2019.

But you probably won’t be celebrating.

That’s because most companies still have a lot of work left to do when it comes to full compliance. And if you’re one of those companies, you probably don’t even know it.

Truth is, GDPR compliance isn’t a one-and-done activity. A common misconception is once the 2018 deadline hit, companies could wash their hands of the mandate.

Not so.

The GDPR is an active exercise, an ongoing execution of privacy best practices.

And when 71% of marketers believe lack of compliance could have a detrimental impact on their companies’ ability to conduct business, the implications are something to take seriously.


You may remember the onslaught of companies – perhaps your own included – rushing to get GDPR compliant processes in place before the deadline.

It was a chaotic time of window-dressing websites and creating cookie updates.

And it was followed by an eerie silence of privacy inaction.

There was a check-the-box mentality only fostered by the fact governing boards took seemingly no immediate action against non-compliant organizations.

Large companies who had doled out copious amounts of money for the update thought they were sitting pretty. Small companies who struggled to implement every iota of the regulation thought they were home free.

Somehow the reality of GDPR non-compliance fell off the radar: The consequences are severe.

From large corporations to small startups, regulators didn’t discriminate against the companies they held accountable for following the rule. Google paid $57 million for not properly disclosing data collection practices. CNIL hand slapped startup Teemo in October 2018 for not asking for consent when gathering geolocation data. And over 18 investigations are underway for big tech companies, including a potential $1.6 billion fine for Facebook.

Fact is, the people who created this privacy policy are bulldogs when it comes to enforcement. And that’s only going to become more the status quo as time passes.

This means the GDPR birthday should renew a sense of urgency for companies to improve existing compliance processes from 2018, or to finish implementing GDPR if they haven’t already.

Unlike other regulations, privacy laws are not a one-time or even once-a-year activity.

They have to be reviewed constantly – we suggest at least quarterly – and updated on an ongoing basis.

Year two of the GDPR regulation is the perfect time to execute this culture of privacy normalcy.


The GDPR of 2018 was only the beginning for privacy regulations.

Most experts are calling for the United States and Canada to pass down similar mandates in the next 5-10 years. The California Consumer Privacy Act (CCPA) is one state’s response to this outcry and will probably be followed soon by like-minded laws from other state governments.

Because of this long-term perspective, it’s important for companies to understand that the first year of the GDPR implementation only covered the fundamentals of privacy rights.

During 2019, regulators will articulate even more clearly their expectations.

They’ll detail what’s most important to have in place based on the next round of fines they intend to levy. And they may even addend the regulation to include research brought to light over the past 12 months.

This should underscore the fact companies shouldn’t wait to get their houses in order when it comes to privacy updates.

Privacy will eventually hold the same weight in an organization as the finance, HR, and legal departments.

Business executives and owners should view year two as an opportunity to overhaul their companies’ privacy processes, ensuring they take the front seat.

After all, the GDPR highlights the need for a sustainable process to review all existing vendors on a regular basis and vet all new processors against privacy, security, and requirements.

Data inventories are becoming commonplace.

Unfortunately, security and data breaches are, too.

The GDPR and future privacy laws aren’t just enforcing these rules as a show of power. Rather, they’re supporting company-consumer relationships for what is fast becoming a way of life.


61% of businesses from a Deloitte survey said they believe the GDPR has benefits beyond just implementation. Of those, 21% expect significant benefits, including competitive advantage, improved reputation, and business enablement.

These privacy officers get it.

Privacy regulations like the GDPR are an opportunity to build strong relationships with customers based on trust.

Trust is the building block of any successful, long-term relationship.

And when long-term relationships will get you more money consistently – it’s six times more expensive to win a new customer than retain an existing one – the GDPR starts to make a lot of sense.

B2B consumers are looking for compliant companies who care about their privacy. In fact, some customers will abandon companies who ignore privacy best practices.

B2C consumers are especially savvy when it comes to this. These people are especially tuned in to privacy no-nos such as emails sent without permission and missing website opt-ins.

It’s true: Being GDPR ready gives your company a competitive advantage.

If you didn’t start in 2018, you need to start now. If you implemented last year, you need to update and improve.

This will involve scrutinizing critical parts of the GDPR requirements such as those listed below. Adding these might be enough:

  1. Data inventories
  2. Vendor management
  3. Privacy notices, cookie consent, and marketing activities
  4. Security and data breaches

Companies aren’t just responsible for creating repeatable privacy processes for these four areas.

Training your team is critical to a successful privacy program. We’re talking every employee, not just your direct reports. Annual security meetings or courses don’t cut it anymore. Instead, implement company-wide communications, monthly tips, quarterly updates, in-person or online events, and contests.

Doing this ensures privacy is a shared team goal and something in which each person is significantly invested. Privacy compliance will simply become a regular part of doing business.

And your team won’t be surprised or unprepared for the next international, national or statewide privacy law.

Conclusion: The GDPR Compliance Challenge

There’s no doubt there are moving parts that require constant fine-tuning when it comes to GDPR and other privacy standards.

It’s crucial for a capable professional to manage these changes.

Yet this highlights one of the main challenges companies face when it comes to privacy law compliance: 43% bemoan lack of expert staff and 31% admit they have a limited understand of GDPR regulations.

While these challenges are overwhelming, they’re not impossible to solve.

And with GDPR compliance something you can’t afford to ignore, you have no choice but to find a way to overcome them.

The first step is education.

There are a litany of reliable resources online to help you understand the privacy law. You can check out our free GDPR Resource Library to get started.

The next step is assigning a point person.

If you don’t have a CISO or an appropriate person on your team to step into the role, it may be time to hire an outside resource. Even if you’re in the CISO role and feel over your head when it comes to GDPR planning and implementation, bringing in a third-party is a good idea.

With more than 20 years of experience, our team of privacy experts can step in to assess the situation. We’ll act as an extension of your team to create a game plan for tackling the GDPR. We can even serve as a fractional Privacy Officer to help over a longer period of time.

Whatever personnelle direction you go in, it’s important you start now. Year two of GDPR is not a time to rest on your laurels.

It’s a time to take action on a business-changing imperative. Get a free GDPR first-year audit or plan your second year goals – reach out today!