These policies cover the use of an organization’s data by software or hardware vendors or consultants

Context

If your organization is using external contractors or volunteers to analyze or visualize your data, build an app for your program, or conduct an evaluation of your programs that will involve the collection of digital data, you want to extend your values onto their work. You will also want to make sure they are meeting your standards for security, privacy, and consent.

Choices/Tradeoffs

You may limit your choices of vendors if your terms of use are too restrictive. You may also encounter vendors who are used to working with certain types of data that you don’t want to make available, and that this limits their ability to create value-appropriate applications for you. On the other hand, you may wish to impose security standards on vendors that they can’t meet, either in good faith or without drastically increasing their costs to you.

You might also be interested in resources for working with Mobile Application Developers (see  http://www.applicationprivacy.org/)

Related Documents

Vendor Cyber Security Questionnaire
Extensive review of vendor’s security capabilities
View Document Download
Subcontractor or Team IP agreement
Covers IP and confidentiality when a vendor is subcontracting or partnering with another entity.
View Document Download
NDA with IP Language
Covers the controls on IP as part of a non-disclosure agreement. Can be used in other settings as well.
View Document Download
IP Language for contracts
For an organization claiming IP ownership, this language can fit in many contracts.
View Document Download
Guide to negotiating digital privacy and data security
Notes from a contract lawyer for negotiating with vendors about digital privacy and data security.
View Document Download
Vendor Confidentiality and Security Agreement
Contract language for ensuring vendor maintains confidentiality of client data, with security requirements.
View Document Download