Managing Data Security Risks in Outsourcing Contracts

Corporate America's love affair with outsourcing and the global trend-line in data protection law are on a collision course. The globalization of service-based economies is accelerating, as both onshore and offshore vendors of outsourced services offer savings and efficiencies that companies cannot ignore. At the same time, countries that seek to ride the wave of outsourcing to grow their local economies are under pressure to enact privacy and data laws resembling Western-style fair information practices. And in the current election year environment, legislators in the United States are likely to seek further controls on companies that send their customer data (and jobs) overseas. Companies that are thinking about outsourcing the processing or storage of customer data, or other protected information, are well-advised to do thorough diligence on both applicable data protection laws, and on their vendors' abilities to comply with those laws, before entering into outsourcing agreements. Although the risk of privacy and data protection violations cannot be eliminated in outsourcing relationships, properly drafted data security provisions in an outsourcing contract can clearly allocate the parties' respective duties and mitigate a customer's exposure to the threat of data security breaches.