“A significant data breach is likely to cost the company materially, and costs could drag on for a number of years,” analyst Shlomo Rosenbaum, commenting on the Equifax breach.

Organizations increasingly rely on third-party service providers for data collection, processing, transfer and storage. As a result of this dependence on external data management sources, most companies are rethinking data breach risk and cost allocations in new and existing vendor agreements.

Limitation of liability and indemnification clauses form the framework for reducing unforeseeable, and potentially devastating, data breach costs. To defend against unpredictable damages, these clauses are fast becoming the most fiercely negotiated language in service provider agreements.  Both liability and indemnity have taken on new importance as organizations become acutely aware that the customer, not the vendor, most likely has the ultimate responsibility for data breached while in the hands of a vendor. The harsh reality that a majority of state statutes allocate the risk and costs of unauthorized disclosure to the data owner, not the vendor, is a red flag in contract negotiations. Customers now realize that they are probably legally required to investigate a breach, provide required notifications and cover any and all costs related to a breach despite the fact the vendor is the sole culpable party.  Under most state statutes, a service provider’s obligations, and liability for costs, end with notification to the customer.  Simply put, if the organization’s sensitive data is breached while under the control of a vendor, the vendor’s only obligation is to notify the organization. It is then the customer’s obligation to handle the fallout, unless the customer’s contract with the vendor provides otherwise.
Continue Reading Allocation of Data Breach Risks and Costs in Vendor Contracts: Negotiate, Negotiate, Negotiate (And Negotiate Again!) Limitations on Liability and Indemnification