P6.4

The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary.

Points of Focus

Evaluates Third-Party Compliance With Privacy Commitments [P][C]

The entity has procedures in place to evaluate whether third parties have effective controls to meet the terms of the agreement, instructions, or requirements.

Remediates Misuse of Personal Information by a Third Party [P][C]

The entity takes remedial action in response to misuse of personal information by a third party to whom the entity has transferred such information.

Obtains Commitments to Report Unauthorized Disclosures [P][C]

A process exists for obtaining commitments from vendors and other third parties to report to the entity actual or suspected unauthorized disclosures of personal information.

Evidence Requests

Area of Focus	Artifact	Description
Privacy	Data Sharing Agreement	Documented evidence of formal data sharing practices that address, at a minimum: • The business justification for the data sharing; • The type / category of data being shared; • The third-parties the data is being shared with; • Lawful bases for data sharing; and • Data subject rights.
Third-Party Management	Third-Party Contracts	Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections.

Points of Focus​

Evidence Requests​

Points of Focus

Evidence Requests