PRIV- 17 – Third-Party Data Sharing

What is this control about?

Implementing the control ‘Third-Party Data Sharing’ is crucial for organizations to safeguard the privacy and security of the personal data they collect and process. Third-party data sharing involves the transfer of sensitive information to external entities, such as vendors, partners, or service providers, for various purposes like data processing, analytics, or marketing.

Available tools in the marketplace

Tools:

Alation Axon

Available templates

TrustCloud has a curated list of templates internally or externally sourced to help you get started. Click on the link for a downloadable version:

• N/A- No templates for this section

Control implementation

Here are some guidelines to implement a Third-Party Data Sharing:

• Identify Data Sharing Requirements: Begin by identifying all data sharing requirements within your organization. Understand the types of data shared with third parties, the purpose of sharing, and the legal or contractual obligations related to such data transfers.
• Conduct Risk Assessment: Perform a risk assessment to evaluate the potential risks associated with sharing data with third parties. Assess the impact of data breaches, unauthorized access, data loss, and other security concerns.
• Create Data Sharing Policy: Develop a comprehensive data sharing policy that outlines the guidelines and procedures for sharing data with third parties. This policy should cover data protection measures, consent requirements, data handling, and the responsibilities of both parties involved.
• Perform Due Diligence: Before engaging with third parties, conduct thorough due diligence. Evaluate their security and privacy practices, data protection policies, and compliance with relevant regulations.
• Vendor Management Program: Implement a robust vendor management program to monitor and manage third-party relationships. Regularly review their security controls, compliance status, and data handling practices.
• Data Sharing Agreements: Create legally binding data sharing agreements with third parties. These agreements should include the scope of data sharing, purpose, data protection measures, rights and obligations of both parties, and procedures for incident reporting and breach notification.
• Data Minimization: Share only the necessary data with third parties and ensure that it is limited to what is required for the intended purpose. Avoid sharing sensitive or irrelevant data.
• Consent Management: Establish a mechanism to obtain explicit consent from data subjects for sharing their information with third parties. Maintain records of consent for auditing purposes.
• Data Encryption and Anonymization: Implement encryption and anonymization techniques to protect sensitive data shared with third parties. Ensure that data is transmitted and stored securely.
• Security Incident Response Plan: Develop a robust incident response plan that includes procedures for handling data breaches or security incidents related to third-party data sharing.
• Regular Audits and Monitoring: Regularly audit and monitor third-party data sharing activities to ensure compliance with policies and agreements. Perform internal and external audits to assess the effectiveness of controls.
• Employee Training: Train employees involved in data sharing processes to understand the importance of data protection and privacy. Educate them about the control measures in place and their role in safeguarding data.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

• Data Sharing Policy:

Provide a documented data sharing policy that outlines the organization’s guidelines and procedures for sharing data with third parties. The policy should detail the types of data that can be shared, the purposes of data sharing, the process of obtaining consent, data protection measures, and the responsibilities of both the organization and the third parties involved.

• Data Sharing Agreements:

Provide copies of legally binding data sharing agreements with third parties. These agreements should clearly define the scope of data sharing, the purpose of sharing, the security and privacy measures to be implemented, incident reporting and breach notification procedures, and the rights and obligations of both parties.

• Consent Records:

Provide records of explicit consent obtained from data subjects for sharing their information with third parties. These records should include the date and method of consent, the scope of data sharing, and any specific restrictions or conditions associated with the consent.

Evidence example

For the suggested action, an example is provided below:

• Data Sharing Policy

Use this policy as an example.

• Data Sharing Agreements:

Use this Data Sharing Agreement Template  as an example

• Consent Records:

Leverage this form and complete it – Information Sharing Consent Form