How to ensure vendors don’t store or sell data?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Trusting that your vendors won't misuse your subscriber data isn't enough. You need it in writing, and you need to know how to verify it.
Start with the contract. Your Data Processing Agreement (DPA) should explicitly state that the processor can't use your data for their own purposes, can't sell it to third parties, and must delete it when the relationship ends. If a vendor's standard DPA is vague on these points, that's a flag.
Check their privacy policy and sub-processor list. A vendor who sells data typically can't hide it entirely. Look for language about "sharing data with partners for marketing" or "using aggregated data for service improvement." Those phrases can cover a lot of ground. Your sub-processor list should tell you who else touches your data.
Ask directly. During procurement, ask: "Do you use our subscriber data in any aggregated or anonymized form for your own purposes?" You'd be surprised how often vendors clarify their practices when asked plainly.
Audit rights. Your DPA should include the right to audit compliance, or at minimum the right to request a third-party audit report (SOC 2 Type II is the most common standard). If a vendor refuses to include any audit mechanism, that's a serious concern.
If you're already using a vendor and have doubts, our SOS hotline can help you review your current contract terms.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
