Liability allocation depends on the contract's security requirements, indemnity provisions, and limitation of liability terms. The data owner typically retains notification obligations regardless of where the breach occurred.
Vendor limitation clauses frequently cap recovery well below exposure.
Alternative Names:
Third-Party Breach Liability|Supply Chain Breach Liability
Why it Matters?
Limitation of liability caps in vendor agreements are frequently set at fees paid, which bears no relationship to breach exposure and leaves the data owner absorbing the loss while retaining notification obligations. Negotiating a carve-out for data security incidents is the control, and it is achievable with most enterprise vendors. Vendor cyber insurance requirements with the client as additional insured provide a secondary source.
Frequently Confused with
Related terms
Frequently asked questions
Why are vendor liability caps a problem?
What is the control?
