Third-Party Vendor Data Privacy Risk Management

Summary

This practice note outlines legal requirements and best practices for mitigating third-party vendor risks by ensuring that vendor contracts comply with U.S. state privacy laws and by conducting data protection assessments (also known as "risk assessments") when vendors process personal information in ways that may present a significant risk to consumers' privacy or security.