Drafting Data and Cybersecurity Provisions in Third-Party Vendor Agreements: Limits to Liability, Indemnification

Cyber risks are increasing as more ubiquitous and sensitive data is stored on connected devices such as laptops, tablets, routers, smartwatches, manufacturing equipment, and even automobiles. While these are valuable tools for organizations, their proliferation has led to greater network vulnerability, increasing the possibility of a cybersecurity incident.

The use of third-party data and payment processors can significantly streamline operations and help an organization focus on its core missions. Organizations must be aware of the risks associated with using these data processors, which represent another category of a third-party vendor that exposes a company to significant cybersecurity risk.

Considering the potential harm that a third-party breach or other misuses of shared data can cause, organizations should devote serious time and effort to address these threats before they arise. In addition, companies may be obligated, under specific regulations, to verify such third parties' security and privacy capabilities.

Organizations should create a vendor inventory to identify precisely which outside entities have access to what information. The inventory should include a data classification exercise, which involves categorizing data shared with third parties according to importance and sensitivity and determining the level of security required for vendors in possession of data in each category.

Counsel for businesses can also limit the liability stemming from third-party breaches through contractual agreements. Third-party service provider contracts should require prompt notification if a security breach occurs, and the vendor should be contractually required to maintain an adequate cybersecurity response plan.

Notification periods should be consistent across all contracts. Failure to timely notify of a breach should constitute a material breach under the contract, allowing the company to cut ties with a vendor that fails to provide this crucial notification. Companies should ideally have broad indemnification language in third-party vendor agreements, holding the vendor responsible for costs and liability arising out of or in connection with a vendor data breach. Companies should also consider purchasing insurance that covers loss due to third-party cybersecurity breaches.

Listen as our authoritative panel discusses data processor security and what routine audits, assessments, and training should include. The panel will address the requirements of third-party vendor agreements, including the limitations of liability and indemnification provisions.