June 18, 2019

June 17, 2019

Subscribe to Latest Legal News and Analysis

Data Privacy and Security Contractual Provisions

A dispute between parties, or in the middle of a security incident, is not the best time to determine whether you have sufficient contractual provisions in place with a customer or vendor. Lately, I have been asking clients these questions: “Do you have a contract in place and what does it say about ‘this?’” or “What are our obligations under our contract with the customer?” or “What does the vendor have to tell us about ‘this’ in the contract?”

Often when we get and read a contract, it is silent on what we need to rely upon, or is ambiguous or adverse to the client’s position. Often times, the contract has not been reviewed by legal and has been signed by the business unit without negotiation. And then when the contract needs to be reviewed to determine the applicable provisions when there is an issue, it becomes very difficult to make the other party agree to do something that might be fair under the circumstances because it wasn’t addressed in the contractual language.

Virtually every business relationship or merger and acquisition these days involves some sort of data sharing, transmission, access or use between the contractual parties. And yet it is shocking the number of times we get involved in a data security issue for a client with another business and find there is no contractual language applicable to data privacy and security. When there is no language to address data privacy and security issues, the parties duke out what they will agree to or not agree to, who will pay for what, and who has insurance, and they end up pointing the finger indiscriminately. It is much easier to address a data security issue when there is contractual language in place between the parties.

Whether you have a formal vendor management program in place or not, as you evaluate contracts going forward, or during your next merger or acquisition, consider inserting contractual language and representations and warranties about data privacy and security. That way, when an issue occurs, the obligations of the parties will be unambiguous and the dispute can be resolved in a more amicable manner.

Copyright © 2019 Robinson & Cole LLP. All rights reserved.


About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...