A dispute between parties, or in the middle of a security incident, is not the best time to determine whether you have sufficient contractual provisions in place with a customer or vendor. Lately, I have been asking clients these questions: “Do you have a contract in place and what does it say about ‘this?’” or “What are our obligations under our contract with the customer?” or “What does the vendor have to tell us about ‘this’ in the contract?”

Often when we get and read a contract, it is silent on what we need to rely upon, or is ambiguous or adverse to the client’s position. Often times, the contract has not been reviewed by legal and has been signed by the business unit without negotiation. And then when the contract needs to be reviewed to determine the applicable provisions when there is an issue, it becomes very difficult to make the other party agree to do something that might be fair under the circumstances because it wasn’t addressed in the contractual language.

Virtually every business relationship or merger and acquisition these days involves some sort of data sharing, transmission, access or use between the contractual parties. And yet it is shocking the number of times we get involved in a data security issue for a client with another business and find there is no contractual language applicable to data privacy and security. When there is no language to address data privacy and security issues, the parties duke out what they will agree to or not agree to, who will pay for what, and who has insurance, and they end up pointing the finger indiscriminately. It is much easier to address a data security issue when there is contractual language in place between the parties.

Whether you have a formal vendor management program in place or not, as you evaluate contracts going forward, or during your next merger or acquisition, consider inserting contractual language and representations and warranties about data privacy and security. That way, when an issue occurs, the obligations of the parties will be unambiguous and the dispute can be resolved in a more amicable manner.