Rob Reeves, CEO and President, Redfish Technology

As the CEO of a recruiting firm, I know how important data protection is. My clients and candidates trust me to keep their personal information safe, and that extends to any third parties I bring on. Ultimately, it’s my business reputation on the line, so if I’m considering working with a firm whose policies are lax, I’ll suggest a remedy before signing the contract.

Once you’re committed, you’ve lost your leverage, so negotiating early is key.

Most companies are happy to take a look at their own policies and update them where needed, but a few have balked at the idea. In those cases, I suggest a fractional team. Borrowing the workers required allows me to install them under my own company’s protocols, and ensures no additional risk to my associates.

Harrison Jordan, Founder and Managing Lawyer, Substance Law

Consider having your third-party partner provide what’s called an “indemnification” that would protect you if you suffer a loss, damage, or a claim from a third party due to the negligence of your partner in respect of privacy and security risks.

This allows you to shift risk to your partner and may get your partner to review their policies and consider bolstering them—or risk having to pay you out big bucks under the indemnification. If they won’t provide you an indemnification, you’ll want some other reassurance that you won’t feel the ill effects of a policy mismatch, such as ensuring your agreement allows you to seek damages for consequential damages.

Amit Doshi, Founder and CEO, MyTurn

One essential strategy we implement at “MyTurn” to mitigate privacy and security risks when working with third-party vendors is conducting thorough due diligence before entering any partnership. This involves rigorously evaluating the third party’s security policies, practices, and compliance with relevant regulations. We also insist on including specific security requirements and responsibilities within our contracts to ensure that the third party meets our cybersecurity standards.

Regular audits and assessments are part of our ongoing relationship, enabling us to monitor compliance and address any vulnerabilities or breaches proactively. This layered approach ensures that the privacy and security of our data, and that of our users, are maintained to the highest standards possible.

Bill Mann, Privacy Expert at Cyber Insider, Cyber Insider

The majority of data breaches happen through third-party access. When we work with other companies, we can’t effect change within a company outside of our own, so we take special precautions to guard ourselves against their security policies, or lack thereof.

The most important part of this is compiling a third-party risk assessment. We identify any vulnerabilities and the details of their privacy practices so that we can protect ourselves accordingly. If the third party is deemed too much of a risk, we don’t collaborate with them.

Tom Molnar, Operations Manager, Fit Design

As a web agency, we quite often work with freelancers or subcontractors who may not have the same policies or standards as our agency when it comes to privacy and security. e.g. One strategy we employ to mitigate risks is to ensure that any third party we work with signs a confidentiality agreement or non-disclosure agreement that outlines their responsibilities to protect the privacy and security of our clients’ data.

This agreement helps to hold them accountable for following best practices and complying with any relevant regulations or laws. Additionally, we also provide training and guidance to our freelancers on how to properly handle sensitive information and implement necessary security measures to safeguard data. Regular communication and monitoring of their practices also help us to stay informed and address any potential issues promptly.

Barkan Saeed, CEO, Vizteck Solutions

There have been instances where we have faced issues with our contractors because they didn’t have the same privacy policies that we had for our company. This caused issues in executing contracts. We decided to write the policies that were critical to our business, which we couldn’t compromise on, and we shared them with the third party before doing business with them.

We would only start work with them once they had signed acceptance of these policies. This has resulted in our contractors understanding the policies we have before starting work with us and has improved our relationship with them.

Alex Stasiak, CEO and Founder, Startup House

At Startup House, we always make sure to have a detailed contract in place with any third party we work with, outlining specific privacy and security requirements that must be met. This helps to ensure that everyone is on the same page and that our data is protected.

Additionally, we conduct regular audits and reviews of their security measures to ensure compliance and address any potential risks proactively. By setting clear expectations and staying vigilant, we can minimize the chances of any privacy or security breaches occurring.