Interested in training for your team? Click here to learn more

Drafting Data and Cybersecurity Provisions in Third-Party Vendor Agreements: Limits to Liability, Indemnification

Recording of a 90-minute CLE video webinar with Q&A

This program is included with the Strafford CLE Pass. Click for more information.
This program is included with the Strafford All-Access Pass. Click for more information.

Conducted on Thursday, April 25, 2024

Recorded event now available

or call 1-800-926-7926

This CLE webinar will explore the risks in utilizing outside service providers as data processors. The panel will discuss the need for routine audits, assessments, and training, as well as provide tips on how contracts should address data protection requirements and standards, breaches, and indemnification.


Cyber risks are increasing as more ubiquitous and sensitive data is stored on connected devices such as laptops, tablets, routers, smartwatches, manufacturing equipment, and even automobiles. While these are valuable tools for organizations, their proliferation has led to greater network vulnerability, increasing the possibility of a cybersecurity incident.

The use of third-party data and payment processors can significantly streamline operations and help an organization focus on its core missions. Organizations must be aware of the risks associated with using these data processors, which represent another category of a third-party vendor that exposes a company to significant cybersecurity risk.

Considering the potential harm that a third-party breach or other misuses of shared data can cause, organizations should devote serious time and effort to address these threats before they arise. In addition, companies may be obligated, under specific regulations, to verify such third parties' security and privacy capabilities.

Organizations should create a vendor inventory to identify precisely which outside entities have access to what information. The inventory should include a data classification exercise, which involves categorizing data shared with third parties according to importance and sensitivity and determining the level of security required for vendors in possession of data in each category.

Counsel for businesses can also limit the liability stemming from third-party breaches through contractual agreements. Third-party service provider contracts should require prompt notification if a security breach occurs, and the vendor should be contractually required to maintain an adequate cybersecurity response plan.

Notification periods should be consistent across all contracts. Failure to timely notify of a breach should constitute a material breach under the contract, allowing the company to cut ties with a vendor that fails to provide this crucial notification. Companies should ideally have broad indemnification language in third-party vendor agreements, holding the vendor responsible for costs and liability arising out of or in connection with a vendor data breach. Companies should also consider purchasing insurance that covers loss due to third-party cybersecurity breaches.

Listen as our authoritative panel discusses data processor security and what routine audits, assessments, and training should include. The panel will address the requirements of third-party vendor agreements, including the limitations of liability and indemnification provisions.



  1. Data processor agreements
    1. Vetting vendors
    2. Cybersecurity
      1. Response plan
    3. Notification periods
    4. Indemnification
    5. Limitations on liability
    6. Cyber insurance


The panel will review these and other key topics:

  • How should general counsel develop a vendor inventory for data processors?
  • What requirements for limitations of liability should counsel include in data processor vendor agreements?
  • What are best practices for auditing third-party vendors?


Austin, Patrick
Patrick J. Austin

Of Counsel
Woods Rogers Vandeventer Black

Mr. Austin advises clients on breach response, data privacy, information security, and regulatory compliance related to...  |  Read More

Tantleff, Aaron K.
Aaron K. Tantleff

Foley & Lardner

Mr. Tantleff focuses on providing legal and strategic guidance regarding information technology, outsourcing,...  |  Read More

Access Anytime, Anywhere

Strafford will process CLE credit for one person on each recording. All formats include course handouts.

To find out which recorded format will provide the best CLE option, select your state:

CLE On-Demand Video