Data Sharing With Third Parties: The Underestimated Risk for Businesses

What does sharing data with third parties mean, and why is it risky?

Sharing data with third parties means that a company transfers personal data to external service providers or partners, such as cloud providers, agencies or payroll services. The risk: the company remains responsible for the data, even when someone else processes it. Without a data processing agreement, a review of security measures and control over sub-processors and third-country transfers, companies face fines, liability and a loss of trust.

Companies collect and process large amounts of data every day to optimise their business processes and serve their customers better. But this wealth of data also comes with great responsibility. Sharing data with third-party providers can carry significant risks that are often underestimated.

Data protection scandals and strict legal requirements such as the GDPR have raised awareness of data protection and compliance. Companies must be aware of their responsibility and comply with legal requirements to avoid hefty fines and reputational damage.

Data sharing can take various forms, from processing customer data through cloud providers to sharing financial data with tax advisers. It involves not only the data itself but also the associated processes and security measures. Without adequate safeguards, data sharing can lead to data breaches and significant legal consequences.

Processing on behalf or transfer: the key difference

Not all data sharing is the same. Legally, there are two cases:

• Processing on behalf (Art. 28 GDPR): The service provider only processes the data on your instructions, for example a hosting provider, a newsletter tool or a payroll service. You need a data processing agreement (DPA) for this, but no consent from data subjects and no separate legal basis for sharing the data.
• Transfer to another controller: The recipient uses the data for its own purposes, for example an advertising partner or an insurer. In this case, the transfer itself needs a legal basis under Art. 6 GDPR, such as consent or legitimate interest.

Why compliance is critical for data sharing

At its core, compliance means that a company meets all applicable legal, regulatory and contractual obligations. This is especially critical when sharing personal data with third-party providers – because the risks include not only hefty fines but also a loss of trust among customers, partners and the public.

The obligation to ensure GDPR compliance

Under Art. 5(1) GDPR, personal data must be processed lawfully, for a specific purpose, transparently and securely. When working with external service providers, the responsible company retains data protection responsibility – even if processing is outsourced.

Art. 28 GDPR is key here. Processing on behalf of a controller is only permissible if:

• a data processing agreement (DPA) is in place,
• the service provider has been selected based on data protection criteria,
• and technical and organisational measures (TOMs) to secure the data can be demonstrated (Art. 32 GDPR).

Trust as a competitive factor

Beyond the legal side, compliance is also a strategic issue: customers, investors and partners increasingly value transparent and secure data processes. Companies that convince with structured policies, regular audits and documented security measures build trust – a decisive competitive advantage in the digital age.

Legal framework and its implications

The legal framework for data sharing varies by region and industry. In the European Union, the General Data Protection Regulation (GDPR) is the most important set of rules governing the processing of personal data.

When sharing data, the GDPR obliges companies, among other things, to:

• have a legal basis for every transfer to another controller (Art. 6 GDPR),
• carefully select processors and sign a DPA (Art. 28 GDPR),
• implement appropriate technical and organisational measures (Art. 32 GDPR),
• document all processing activities and report data breaches within 72 hours (Art. 30 and 33 GDPR).

Violations can be penalised with fines of up to €20 million or 4% of global annual turnover – not to mention the reputational damage.

Hidden risks: where the real danger lurks

When it comes to sharing data with third-party providers, many people immediately think of obvious risks such as hacker attacks, data leaks or the loss of sensitive information. But the real dangers often run deeper – in the details of the collaboration, which are easily overlooked in day-to-day business. This is exactly where the biggest vulnerabilities for compliance and data security arise.

1. Unclear or missing contract terms

Many companies transfer data to service providers without signing a valid data processing agreement (DPA) under Art. 28 GDPR – or they use outdated, unclear contract templates.

Example: A mid-sized online shop hires an external agency to send newsletters. The agency gets access to the entire customer database – but there is no DPA regulating how this data should be handled, who may process it or how long it is stored. In the event of a data breach, the commissioning company is primarily liable. The agency may also be liable under Art. 82 GDPR if it breaches its obligations as a processor.

2. Lack of control over sub-processors

Even when a service provider is contractually bound, many providers rely on additional sub-processors – such as hosting providers, payment service providers or external development teams. This “chain” of data sharing is often not fully transparent.

Example: A German company uses a US-based cloud service for CRM and support. This provider, in turn, hosts the data with a third-party provider in India – without this being disclosed in the contract or technically secured. As a result, the company loses control over the data flow and risks violating the GDPR, particularly regarding third-country transfers (Art. 44 et seq. GDPR).

3. Inadequate technical and organisational measures (TOMs)

Data security stands or falls with the measures actually implemented. But not all third-party providers apply sufficiently high standards – for example in encryption, access controls or data deletion after a contract ends (Art. 32 GDPR).

Example: HR software stores application data on unencrypted servers. Unauthorised internal access initially goes unnoticed. Because the commissioning company never reviewed the security measures, it is considered jointly responsible.

4. Lack of oversight and audits

Many companies fail to regularly review their service providers – whether through audits, self-disclosures or certifications (e.g. ISO 27001, SOC 2). Without clear control mechanisms, it remains unclear whether the provider actually meets the agreed data protection standards.

Example: A company outsources payroll and relies on the provider’s claim that it “works in a data protection-compliant manner”. A later review reveals that sensitive employee data was stored unprotected on local servers – a clear violation made possible by a lack of oversight.

Legal pitfalls: GDPR, processing on behalf & more

The GDPR is clear: anyone who shares personal data with third parties remains responsible for it – and must secure the collaboration properly under the law. Nevertheless, critical oversights keep creeping in, which can lead to hefty penalties.

1. Missing or defective data processing agreements (Art. 28 GDPR)

A widespread mistake is working together without a DPA or with incomplete contract clauses. According to Art. 28(3) GDPR, a DPA must bindingly regulate, among other things:

• the subject matter and duration of the processing
• the nature and purpose of the processing
• the categories of data subjects and data
• the processor’s obligation to confidentiality and security
• clear instructions and the controller’s audit rights

Practical example: A SaaS tool for marketing automation is commissioned, but the DPA is merely an appendix to the terms and conditions with no provisions on deletion periods or sub-processors. During a review, the data protection authority does not accept this contract as sufficient – with consequences for the commissioning company.

2. Impermissible data transfers to third countries (Art. 44 et seq. GDPR)

If a third-party provider outside the EU is involved, Chapter V of the GDPR applies. Without an adequacy decision or appropriate safeguards such as standard contractual clauses (SCCs), the data transfer is unlawful – even with large providers.

Example: A German company uses a US-based analytics tool. The data is stored on servers in the US without any basis for the transfer. Since the “Schrems II” ruling (CJEU 2020), this has been unlawful. Today, transfers to the US are possible if the provider is certified under the EU-US Data Privacy Framework (since 2023) or if SCCs with additional safeguards where necessary are in place. If neither applies, this constitutes a GDPR violation. If you want to avoid the risk altogether, consider European alternatives to US tools.

3. Missing documentation and accountability (Art. 5(2) & Art. 30 GDPR)

A common pitfall is insufficient record-keeping: companies must be able to prove when, how and with whom they shared personal data – including the purpose, legal basis and security measures taken.

Example: During a data protection audit, a company cannot prove which provider processed applicant data or whether a DPA is in place. The absence of this documentation counts as a violation of the accountability principle under Art. 5(2) GDPR.

4. Missing consent or incorrect legal basis (Art. 6 GDPR)

Especially with third-party providers in marketing or tracking contexts, companies mistakenly rely on “legitimate interest” when consent would actually be required – particularly when user data is shared for the third party’s own purposes.

Example: A website uses a chat widget that transmits IP addresses and behavioural data to a third-party provider – without cookie consent or a notice in the privacy policy. This can be classified as unauthorised data processing.

Best practices for secure data sharing

The risks of working with third-party providers cannot be eliminated entirely – but they can be significantly reduced. What matters is a structured approach that combines legal, technical and organisational measures. The following best practices help you make data sharing secure and GDPR-compliant:

1. Carefully select and vet third-party providers

• Shortlist only providers that can demonstrate GDPR-compliant data processing (e.g. through certifications such as ISO 27001, SOC 2 or TISAX).
• Use data protection checklists or self-disclosures to assess risk before signing a contract.
• Reject providers that do not give clear information about sub-processors, storage duration or data flows.

Tip: Introduce an internal “privacy due diligence” process before commissioning a provider.

2. Sign GDPR-compliant contracts (including a DPA)

• Always sign a DPA under Art. 28 GDPR – with individual provisions, not just generic ones.
• Regularly review contracts to keep them up to date (e.g. when sub-processors change).
• Contractually exclude data transfers to third countries without appropriate safeguards.

Tip: Use your own DPA templates or critically review a provider’s DPA before signing.

3. Ensure technical and organisational measures (TOMs)

• Make minimum standards such as encryption, two-factor authentication and access rights management mandatory.
• Data minimisation: only transfer as much data as is strictly necessary.
• Include requirements on deletion periods, backups and access controls in the contract.

Tip: Require a list of TOMs within the DPA – including regular proof or audit rights.

4. Introduce regular audits and monitoring

• Review third-party providers annually or as needed, e.g. through data protection evaluations, technical tests or certification checks.
• Watch for changes at the provider (e.g. new sub-processors).
• Clearly define violations and security incidents and back them up with escalation plans.

Tip: Define fixed review intervals and responsibilities in your data protection strategy.

5. Establish clear internal processes and responsibilities

• Create a central register of all third-party providers with DPAs, purposes, deletion periods and contact persons.
• Set binding policies for data sharing – including review obligations before a contract begins.
• Define roles: who may approve data sharing? Who documents it?

Tip: Use a data protection management tool for structured control.

6. Train employees and raise awareness

• Regular training on data protection, third-country risks, secure tools and GDPR obligations.
• Walk through concrete use cases (e.g. “Am I allowed to use this tool?”).
• Communicate clear reporting channels for data protection violations and uncertainties.

Tip: Build data protection into onboarding and mandatory annual training.

The role of technology in ensuring compliance

Technology can play a decisive role in ensuring compliance. With data protection management software, companies can automate and monitor their data processing workflows and ensure that all legal requirements are met.

In addition, modern encryption technologies and access management systems provide extra protection for sensitive data and help minimise the risk of data breaches.

Conclusion: regaining control through deliberate processes

Secure data sharing and compliance with regulatory requirements are essential for protecting companies and their customers. Through deliberate processes and suitable technologies, companies can regain control over their data and minimise the associated risks.

Ultimately, a strong compliance culture not only helps meet legal requirements but also strengthens the trust of customers and partners and fosters long-term business success.

With heyData’s vendor risk management, you assess your service providers in a structured way, manage DPAs and sub-processors in one place and keep track of third-country transfers.

Take the first step: Book a free demo now