Protecting your data from third-party failures

Third-party data risk management

Many data incidents do not start inside the organisation. They come through vendors, cloud platforms, software providers, consultants, outsourced teams, payment processors, logistics partners, and other third parties that receive, host, transmit, or support access to personal data.

In Nigeria, outsourcing a function does not mean outsourcing accountability. The NDPC's General Application and Implementation Directive 2025 makes it clear that data controllers and processors must take reasonable steps to ensure that third parties they engage are compliant, and that organisations may remain accountable for the actions or inactions of parties they permit to process personal data.

1. Map every vendor that touches personal data

The first step is visibility. Create a register of third parties that collect, store, access, analyse, host, support, or transfer personal data for your organisation. Include software subscriptions, cloud storage, payroll systems, CRM tools, website plugins, customer support platforms, consultants, contractors, and service providers.

2. Carry out vendor due diligence before onboarding

Before a vendor receives personal data, assess whether it can protect that data. Review its security controls, privacy policy, breach response process, subcontractor use, data retention practice, hosting location, staff access controls, and ability to support data subject rights.

For high-risk vendors, due diligence should be deeper. A payroll processor, health record platform, identity verification provider, payment gateway, or cloud hosting provider should not be assessed with the same light-touch checklist used for a low-risk office supplier.

3. Use strong data processing agreements

A Data Processing Agreement should do more than say "the vendor will comply with the law." The NDPC GAID identifies practical items that should be covered, including the obligations of the controller and processor, purpose of processing, location, scope, lawful basis, responsibilities, technical and organisational measures, potential risks, confidentiality, tenure, restrictions, indemnity, insurance, force majeure, and dispute resolution.

4. Monitor vendors after the contract is signed

Vendor risk is not solved at onboarding. Systems change, staff change, subcontractors change, and security weaknesses appear over time. Review high-risk vendors periodically and require evidence of continued compliance, especially where the vendor has remote access, stores sensitive data, or supports business-critical systems.

5. Prepare for third-party breach scenarios

Your incident response plan should include vendor incidents. If a third party is breached, you may need to determine what data was affected, whether Nigerian data subjects are involved, whether NDPC notification is required, whether affected individuals should be informed, and what containment steps are being taken by both parties.

Do not wait until a breach occurs before asking vendors how they will communicate incidents. Contract terms should require fast notification, evidence preservation, access to incident details, and cooperation with regulatory reporting.

6. Exit cleanly when the relationship ends

Third-party failure can also happen after a contract ends. Ensure the vendor returns or securely deletes personal data, disables access, confirms deletion of backups where feasible, and provides closure evidence. Dormant accounts and forgotten integrations are common sources of avoidable exposure.

Frequently asked questions

Sources and further reading

This article is based on the Nigeria Data Protection Act 2023, the NDPC General Application and Implementation Directive 2025, and NDPC guidance on privacy breach reporting.