According to Gartner, 60% of organizations are now working with more than 1,000 third parties. Despite the added complexities, these relationships are critical to business success – delivering affordable, responsive, and scalable solutions that can help organizations to grow and adapt according to the needs of their customers. But as reliance on third parties grows, so does the exposure to additional risk. In this article, we will discuss how to handle compliance and privacy issues of third-party applications.
We must recognize, manage, and reduce the risks associated with third-party interactions if we are to benefit from them. Effective third-party oversight is more crucial than ever since doing so requires a strong TPRM program. So what practical steps can be taken to ensure that your third-party risk management (TPRM) practices are up to the requirements of our constantly changing commercial landscape?
You cannot guarantee that you will address the underlying causes and dangers if you reduce this type of risk management to a compliance exercise. In fact, it’s simple to overlook potential hazards that could affect your organization by seeing TPRM as a list of basic needs. This is especially true when considering vendors separately. This could indicate that operations aren’t standardized and coordinated across the board, increasing unforeseen risks for your vendors.
The Role of Marketing and PETs (Privacy Enhancing Technologies)
On the PETs front, there has undoubtedly been a lot of activity in the past year. According to a statement made by Meta in August 2021, the company is “spending in a multi-year effort to establish a portfolio of privacy-enhancing technologies and cooperate with the industry on these and other standards that will support the future era.”
The adoption and use of PETs are quite simple and the road is clear for companies and publications that have strong, direct customer ties to generate significant first-party databases. While “walled gardens” like Google, Facebook, and Amazon, for example, provide aggregated rather than customer-level data, companies, and publishers with less direct consumer ties and less deterministic data on their customers will need proxy tools and partnerships to develop superior datasets.
For the majority of firms, the cost is a reasonable place to start and frequently the simplest method to organize your review. You may tier each vendor appropriately by looking at their contractual worth. Consider the sort of risk of your organization when classifying your vendors. Consider elements like geography, technology, and financial risk, and then classify your risks according to how likely it is that they will materialize. The most advanced method is criticality, which rates each vendor by determining which of your critical assets, systems, and processes they impact and what the potential consequences for your organization would be.
Data Protection Schemes
Existing data protection policies (such as a data protection policy or data section in the IT policy; employee data policies or data sections in employee handbooks; data retention policies; security incident contingency plans, etc.); data transfer or sharing agreements; employment contracts; vendor or customer contracts, etc. are examples of typical documents relevant to data protection.
Affiliates in China may employ GDPR-compliant data protection documentation for target enterprises with extensive manufacturing histories, worldwide groups with major EU presences, or groups with affiliates in the EU. Although the GDPR and PIPL differ significantly, many legal obligations have similar notions or justifications.
