Subscribe (Free) to
Daily or Weekly Newsletters
Post a Job

Featured Jobs

Retirement Plan Service Representative

DeMars Pension Consulting Services, Inc.
(Overland Park KS / MO)

Retirement Plan Administrator

Aegis Retirement Partners

Aegis Retirement Partners logo

401k & Defined Contribution Plan Consultant

Planned Retirement Consultant & Administrators, LLC
(Remote / Ridgewood NJ)

Planned Retirement Consultant & Administrators, LLC logo

Manager, 403(b) Plan Operations


Pentegra logo

Defined Contribution Account Manager

Nova 401(k) Associates

Nova 401(k) Associates logo

Senior Defined Contribution Account Manager

Nova 401(k) Associates

Nova 401(k) Associates logo

Regional Vice President Sales - Southeast

The Retirement Plan Company
(Remote / AL / FL / GA / MS)

The Retirement Plan Company logo

View More Employee Benefits Jobs

Free Newsletters

“BenefitsLink continues to be the most valuable resource we have at the firm.”

-- An attorney subscriber

Mobile app icon
LinkedIn icon     Twitter icon     Facebook icon
and Podcasts
  >  Upcoming   |   Recorded
(In-Person or Virtual)
  >  Upcoming   |   Grouped by Location
All   >  Upcoming   |   Grouped by Sponsor

View More Strafford Webinars, Podcasts and Conferences

Drafting Data and Cybersecurity Provisions in Third-Party Vendor Agreements: Limits to Liability, Indemnification


Apr. 25, 2024
1:00 p.m. ET

This CLE webinar will explore the risks in utilizing outside service providers as data processors. The panel will discuss the need for routine audits, assessments, and training, as well as provide tips on how contracts should address data protection requirements and standards, breaches, and indemnification.


Cyber risks are increasing as more ubiquitous and sensitive data is stored on connected devices such as laptops, tablets, routers, smartwatches, manufacturing equipment, and even automobiles. While these are valuable tools for organizations, their proliferation has led to greater network vulnerability, increasing the possibility of a cybersecurity incident.

The use of third-party data and payment processors can significantly streamline operations and help an organization focus on its core missions. Organizations must be aware of the risks associated with using these data processors, which represent another category of a third-party vendor that exposes a company to significant cybersecurity risk.

Considering the potential harm that a third-party breach or other misuses of shared data can cause, organizations should devote serious time and effort to address these threats before they arise. In addition, companies may be obligated, under specific regulations, to verify such third parties' security and privacy capabilities.

Organizations should create a vendor inventory to identify precisely which outside entities have access to what information. The inventory should include a data classification exercise, which involves categorizing data shared with third parties according to importance and sensitivity and determining the level of security required for vendors in possession of data in each category.

Counsel for businesses can also limit the liability stemming from third-party breaches through contractual agreements. Third-party service provider contracts should require prompt notification if a security breach occurs, and the vendor should be contractually required to maintain an adequate cybersecurity response plan.

Notification periods should be consistent across all contracts. Failure to timely notify of a breach should constitute a material breach under the contract, allowing the company to cut ties with a vendor that fails to provide this crucial notification. Companies should ideally have broad indemnification language in third-party vendor agreements, holding the vendor responsible for costs and liability arising out of or in connection with a vendor data breach. Companies should also consider purchasing insurance that covers loss due to third-party cybersecurity breaches.

Listen as our authoritative panel discusses data processor security and what routine audits, assessments, and training should include. The panel will address the requirements of third-party vendor agreements, including the limitations of liability and indemnification provisions.

More Information, How to Register

© 2024, Inc.