Chapter 9 — Third-party data and contracts
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Data flows with partners"]
N2["9.2 Data clauses"]
N3["9.3 Monitoring partners"]
N4["9.4 Ending relationships"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Data flows with partners"]
N2["9.2 Data clauses"]
N3["9.3 Monitoring partners"]
N4["9.4 Ending relationships"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Data flows with partners]
|
v
[9.2 Data clauses]
|
v
[9.3 Monitoring partners]
|
v
[9.4 Ending relationships]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) govern data exchanged with partners; (2) write data clauses into contracts; (3) monitor partner compliance.
9.1 Data flows with partners
Corran exchanges data with carriers, customers, a fuel card provider, an insurer and a software vendor hosting the tracking platform. Lucía lists each flow: data sent and received, purpose, legal basis and current contract terms. She finds that the tracking platform vendor processes customer and driver data on Corran's behalf but the contract lacks the processor terms required by Article 28 of the GDPR. The legal team prioritises updating that contract. Lucía also finds two flows with no written agreement at all, which legal adds to its list.
9.2 Data clauses
Lucía drafts standard data clauses with legal: purpose, data quality obligations such as timeliness targets, security, onward sharing, retention, breach notification within a set time, audit rights and return or deletion at the end. For carriers, quality clauses matter most; for the platform vendor, security and processor terms matter most. She notes that standard clauses speed up negotiations and ensure that data obligations are not forgotten when commercial terms dominate discussions. Legal approves the clauses, and they are used in the next three contract renewals.
9.3 Monitoring partners
Clauses need monitoring. Lucía designs a partner scorecard with timeliness, completeness and incident reporting for each carrier, reviewed monthly with the carrier. For the platform vendor, she requests its independent security assurance report annually and checks that agreed controls appear. When a carrier misses timeliness targets for three consecutive months, the agreement's escalation clause triggers a joint improvement plan rather than immediate penalties. The plan sets out actions on both sides, such as Corran fixing its own interface errors and the carrier upgrading its devices, with a date for reviewing progress together.
9.4 Ending relationships
When Corran replaces its fuel card provider, Lucía checks that the old provider returns or deletes Corran's data as the contract requires. The provider confirms deletion in writing, and Lucía records the confirmation. She also checks that Corran's own systems stop sending data to the old provider. Dr. Achebe notes that exit is the most neglected stage of partner governance, and that confirming deletion protects both the company and the people whose data were shared. She adds an exit checklist to the procedure.
Worked example
Lucía lists partner flows, finds missing processor terms for the platform vendor, drafts standard data clauses, monitors carriers with scorecards and vendor assurance reports and confirms deletion when a provider is replaced.
Synthetic case. Partners are synthetic; GDPR Article 28 is real.
Errors and limits
Contracts negotiated on commercial terms alone often omit data obligations.
Exercises
- EX041 — Missing terms. What was missing from the platform vendor contract? Rubric: 3 = GDPR Article 28 processor terms;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX042 — Carrier clause focus. Which clauses matter most for carriers? Rubric: 3 = quality obligations;; 2 = partly correct;; 1 = other;; 0 = none.
- EX043 — Vendor assurance. What does Lucía request from the vendor annually? Rubric: 3 = its independent security assurance report;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX044 — Three-month miss. What happens after three months of missed targets? Rubric: 3 = a joint improvement plan;; 2 = partly correct;; 1 = penalties;; 0 = none.
- EX045 — Exit check. What did Lucía confirm when changing fuel card provider? Rubric: 3 = written confirmation of deletion;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 09 (chapter 09 of 12)
← Chapter 08 · Course chapter index · Chapter 10 →
Continue to the next authored lesson.