HumenhukCIPP/US Study Guide
Chapter 4: Information Management and Privacy Risk Management

Vendor and Third-Party Risk Assessments

Reviewed by Victor Humenhuk. Published . Reviewed .

Companies remain responsible for vendor actions and must use contract protections (confidentiality, no further use, subcontractor flow-down, breach notice, security, end-of-relationship data handling) and due diligence (reputation, finances, SOC 2, disposal per FACTA Disposal Rule). SolarWinds shows the stakes.

How this supports CIPP/US study

Use this lesson to connect a privacy programme decision with the relevant regulator, duty or enforcement route. Continue with the CIPP/US study guide.

Companies are responsible for the actions of vendors handling data on their behalf, and privacy-policy claims also apply to third parties working with the organization's data. Written-contract protections to consider:

  • Confidentiality provision
  • No further use of shared information beyond contracted purposes
  • Subcontractor flow-down of privacy/security terms; address cross-border flows
  • Requirement to notify and disclose breach promptly
  • Information security provisions (encryption, network security, access controls, segregation, background checks, audit rights)
  • End of relationship - return or deletion of data

Vendor due diligence evaluates reputation, financial condition/insurance, information security controls (e.g., SOC 2 certification), point of transfer, disposal of information (the FACTA Disposal Rule is a good baseline), employee training, incident response, and audit rights. A vendor/third-party risk assessment also reviews data sources/types/location, whether a PIA/DPIA was done, AI and cloud uses, certifications such as SOC 2 or PCI DSS, and subcontractor disclosure.

Key terms - quick answers

What is “SOC 2”?
Set of controls defined by the AICPA; a vendor's compliance certification can evidence its security controls.
What is “FACTA Disposal Rule”?
Rule under the Fair and Accurate Credit Transactions Act of 2003 setting required disposal protections for financial institutions; a good baseline for PI disposal generally.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.