Drafting Data and Cybersecurity Provisions in Third-Party Vendor Agreements: Limits to Liability, Indemnification

A live 90-minute CLE video webinar with interactive Q&A

This program is included with the Strafford CLE Pass. Click for more information.
This program is included with the Strafford All-Access Pass. Click for more information.

Thursday, February 24, 2022

1:00pm-2:30pm EST, 10:00am-11:30am PST

Early Registration Discount Deadline, Friday, January 28, 2022

or call 1-800-926-7926

This CLE webinar will discuss the risks in utilizing outside service providers as data processors. The panel will address the needs for routine audits, assessments, and training, as well as how the contract should address data protection requirements and standards, breaches, and indemnification.

Description

Cyber risks are increasing as more ubiquitous and sensitive data is stored on connected devices such as laptops, tablets, routers, smartwatches, manufacturing equipment, and even automobiles. While these are valuable tools for organizations, their proliferation has led to greater network vulnerability, increasing the possibility of a cybersecurity incident.

Use of third-party data and payment processors can significantly streamline operations and help an organization focus on its core missions. Organizations must be aware of the risks associated with using these data processors, which represent another category of a third-party vendor that exposes a company to significant cybersecurity risk.

Considering the potential harm that a third-party breach or other misuses of shared data can cause, organizations should devote serious time and effort to address these threats before they arise. In addition, companies may be obligated, under specific regulations, to verify such third parties' security and privacy capabilities.

Organizations should create a vendor inventory to identify precisely which outside entities have access to what information. The inventory should include a data classification exercise, which involves categorizing data shared with third parties according to importance and sensitivity and determining the level of security required for vendors in possession of data in each category.

Counsel for businesses can also limit the liability stemming from third-party breaches through contractual agreements. Third-party service provider contracts should require prompt notification if a security breach occurs, and the vendor should be contractually required to maintain an adequate cybersecurity response plan.

Notification periods should be consistent across all contracts. Failure to timely notify of a breach should constitute a material breach under the contract, allowing the company to cut ties with a vendor that fails to provide this crucial notification. Companies should ideally have broad indemnification language in third-party vendor agreements, holding the vendor responsible for costs and liability arising out of or in connection with a vendor data breach. Companies should also consider purchasing insurance that covers loss due to third-party cybersecurity breaches.

Listen as our authoritative panel discusses data processor security and what routine audits, assessments, and training to include. The panel will address the requirements of third-party vendor agreements, including the limitations of liability and indemnification provisions.

READ MORE

Outline

  1. Data processor agreements
    1. Vetting vendors
    2. Cybersecurity
      1. Response plan
    3. Notification periods
    4. Indemnification
    5. Limitations on liability
    6. Cyber insurance

Benefits

The panel will review these and other key topics:

  • How should general counsel develop a vendor inventory for data processors?
  • What requirements for limitations of liability should counsel include in data processor vendor agreements?
  • What should an adequate cybersecurity response plan include?

Faculty

Waller, Elizabeth
Elizabeth (Beth) Waller

Chair, Cybersecurity and Data Privacy Practice
Woods Rogers

Ms. Waller is a cybersecurity and data privacy attorney who uses her significant experience in technology to counsel...  |  Read More

Additional faculty
to be announced.
Attend on February 24

Early Discount (through 01/28/22)

Cannot Attend February 24?

Early Discount (through 01/28/22)

You may pre-order a recording to listen at your convenience. Recordings are available 48 hours after the webinar. Strafford will process CLE credit for one person on each recording. All formats include course handouts.

To find out which recorded format will provide the best CLE option, select your state:

CLE On-Demand Video

Download