How Do I Make Sure My Vendors Protect Customer Data?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Data-processing terms are the parts of a vendor agreement that control how the vendor uses, protects, shares, keeps, and deletes your business and customer data. Before you sign up for any tool that holds customer information, read its privacy and security terms, then put your expectations in writing. You remain responsible to your customers for the data you hand over.

What this means

11.2.7 Data-processing terms

Most small businesses use vendors that store customer data: scheduling, payments, email marketing, customer records, call tracking, website forms, and AI tools. Their terms should cover:

Purpose: the vendor uses your data only to provide the service to you
No other use: no selling or using it for their own marketing or product training unless you agree
Security: reasonable safeguards like encryption and access controls
Staff access: who at the vendor can see the data
Sub-vendors: whether they pass data to other companies, and who
Breach notice: how fast they tell you if something goes wrong
Retention and deletion: how long they keep data and how you get it deleted
Return: how you get your data out, in a usable format, when you leave
Location: where the data is stored, if that matters to you or your customers

Made-up example: Fairway Physical Therapy compares two scheduling apps. One says it may use customer data to improve its products and share it with partners. The other limits use to providing the service, encrypts data, notifies customers of breaches within a set time, and deletes data 30 days after cancellation. Fairway picks the second and saves a copy of its terms.

11.6.4 Vendor privacy review

Before signing, review each vendor’s:

Privacy policy and data terms: what they collect and how they use it
Security page: encryption, multi-factor sign-in, and any outside audits they describe
Data use: especially whether your data trains AI models (see 25.2 Data You Put into AI Tools)
Retention: how long they keep data after you cancel
Deletion: how you request it, and whether they confirm it

Repeat the review once a year, and whenever the vendor changes its terms.

Why it matters

You’re still responsible. The Federal Trade Commission (FTC) tells businesses to find out how a service provider will use and protect data before handing it over, and to put security expectations in the contract rather than relying on informal promises.
Some businesses have specific federal rules. The FTC Safeguards Rule covers many non-bank financial businesses, like tax preparers, mortgage brokers, and collection agencies. It requires them to pick capable service providers, spell out security expectations in contracts, and check on providers over time.
State privacy laws may require contract terms. Some state privacy laws, including California’s for businesses it covers, require specific terms with vendors that process personal information.
Your privacy notice must match. If your notice says you don’t sell or share data, your vendors can’t either (see 11.1.10 Privacy Notice).

Who this applies to

Every business that puts customer data into outside software or gives a vendor access to it. That’s nearly everyone. Businesses handling health, financial, or children’s information face extra rules (see 11.6.2 Sensitive Information).

How to do it

List every vendor that touches data using your data map (see 11.5 Data Map).
Share only what each vendor needs (see 11.6.1 Data Minimization).
Review each vendor’s privacy and security terms using the checklist in section 2. Save a copy or screenshot with the date.
Turn off optional data sharing in each tool’s settings, like product training or partner sharing, where available.
Ask for a data processing agreement if the vendor offers one. Many larger software companies do.
For vendors without standard terms, add a short data clause to your agreement: purpose limits, security, breach notice, return, and deletion.
Turn on multi-factor sign-in for every vendor account (see 11.7.3 Multi-Factor Authentication).
Review yearly and when terms change.

What proof to keep

Saved copies of each vendor’s privacy and data terms, with dates
Signed data processing agreements
Your vendor privacy review checklist for each tool
Screenshots of privacy settings you changed
Deletion confirmations when you leave a vendor

Common mistakes

Never reading the terms of free or cheap tools.
Leaving default settings on that allow the vendor to use your data for other purposes.
No plan to get data back when you cancel.
Forgetting small tools, like a form plugin or a spreadsheet add-on, that also see customer data.
A privacy notice that promises more than your vendors deliver.

When to get help from a pro

Attorney with privacy experience: especially if you handle sensitive data or serve customers in several states. Questions to ask:

Do any federal or state rules require specific terms with my vendors?
Does the FTC Safeguards Rule apply to my business?
What should my vendor contracts say about breach notice and deletion?

Bill’s note

[Bill: add a short note. For example, what you found when you reviewed the data terms of the tools SiteSmarty uses, or a setting you turned off that many owners miss.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the vendors I reviewed and the settings I changed]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: a completed vendor privacy review checklist]
[Result so far:]

Questions people ask

What is a data processing agreement? A contract, or part of one, that limits how a vendor can use and protect the data you give it.

Am I responsible if my vendor has a breach? Often you still have duties to your customers, like notification under state law. See 11.6.6 Breach Notification.

Can a vendor use my customer data for its own purposes? Only if its terms allow it. Read them, and turn off optional sharing where you can.

What happens to my data when I cancel? It depends on the terms. Get your data out first, then request deletion and keep the confirmation.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.2.7 Data-processing terms	Do vendors that handle data have written terms on use, security, breach notice, return, and deletion?	Saved terms or signed agreements for each	No terms reviewed, or vendors free to use data any way	Vendor agreements and saved terms
11.6.4 Vendor privacy review	Has each data vendor’s privacy and security been reviewed within the last year?	Dated checklist for every vendor	No review, or only for large vendors	Review checklists and settings screenshots

Where this fits

Do this first: 11.5 Data Map, 11.2.1 Vendor Agreement

Do this next: 11.2.8 Termination Terms

Sources

Federal Trade Commission, "Stick with Security: Make sure your service providers implement reasonable security measures" (checked October 17, 2026)
Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know" (checked October 17, 2026)
California Privacy Protection Agency, "Does My Business Need to Comply with the CCPA?" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.