Data security & the supply chain: understanding responsibilities, risk and recourse when it comes to suppliers

A £1.25m fine issued by the ICO to the victim of a software supply chain attack, and subsequent group claim against it by hundreds of affected data subjects, illustrates the fallout. There, the attack vector was a chat bot containing malware which was provided by a third party and installed on the victim’s online payment page.

Join us at this session where we will look at: what the data security obligations are when it comes to the supply chain; some of the practicalities around managing third party risk; and the legal options when things go wrong but your supplier is at fault.

Topics under discussion:

• What data security requirements apply to parties involved in the processing chain

• Is a paper-based approach enough? What other practical ways are there to manage third party risk?

• How vendor risk management tools can help establish effective control and oversight of your supply chain.

• What the legal options are when you are in the firing line but your supplier is at fault.

• Indemnities: can these be used to recover regulatory fines from an errant supplier?