Requirement
The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary.
Points of Focus
Evaluates Third-Party Compliance With Privacy Commitments [P][C]
Requirement: The entity has procedures in place to evaluate whether third parties have effective controls to meet the terms of the agreement, instructions, or requirements.
Remediates Misuse of Personal Information by a Third Party [P][C]
Requirement: The entity takes remedial action in response to misuse of personal information by a third party to whom the entity has transferred such information.
Obtains Commitments to Report Unauthorized Disclosures [P][C]
Requirement: A process exists for obtaining commitments from vendors and other third parties to report to the entity actual or suspected unauthorized disclosures of personal information.
Explanation
Vendors and other outsiders who handle personal information must formally commit to protecting it, and the organization must periodically check that they actually do — taking corrective action when they fall short. Auditors examine vendor agreements, compliance assessments, and evidence of follow-up, since third parties are a frequent source of privacy failures.
