During the data mapping process (New Data Mapping Entry > Processing Locations) you established your third party relationships and basic Third Party entries were created. In this section you will add other relevant data recipient information and manage recipients and your contracts. You may dismiss the introduction by clicking the ‘X’.
Add new Third Party
We strongly recommend that all of your Third Parties be used with specific data mapping entries. To avoid unmapped data recipients, create your initial Third Party entry through the data mapping process (New Data Mapping Entry > Processing Locations) and later return to this section to add contract and recipient details. However you may have business reasons to create Third Parties and may do so directly in this section.
Adding Third Parties is found in the ‘Add New’ dropdown. You may capture their details individually (Add New) or perform a bulk upload (Import Third Parties) using the template provided (Third Parties Import CSV).
Add new Third Party manually
To add a third party, click ‘Add New’ from the dropdown.
On the ‘Add New’ pop-up, add your Third Party details. Save when your input is complete. These fields are required on a manual entry: Recipient; Recipient Type; Country; Reason for Sharing. Note that if the Country is not United States, you are required to add Lawful Basis.
After saving, your new manual entry appears in the data recipient listing.
Import Third Parties from CSV
You may perform a bulk upload of Third Parties using the CSV template provided.
From the ‘Add New’ dropdown, download the Third Parties Import csv. This downloads a CSV template file named dataSharingAgreement.csv.
Create the entries using your tool of choice. There are sample entries provided in the template; delete them before you upload. If you use a spreadsheet application like Excel, remember to Save As CSV. This field is required on a CSV upload: Recipient.
The following fields are included in the template.
- Recipient – required field
- Recipient Type
- Website
- Email address
- Telephone Number – optional; prefix with country code e.g., 1-
- Mobile Number – optional; prefix with country code e.g., 1-
- Address 1
- Address 2 – optional; may include State here
- City
- Postal code
- Country – optional; use 2-digit country ISO code
- Postal address 1
- Postal address 2 – optional; may include State here
- PA Postal code
- Reason for Sharing
- Sharing Objectives
- Agreement start date – optional; format YYYY-MM-DD
- Agreement end date – optional; format YYYY-MM-DD
- Sharing Medium
- Sharing Frequency
- Representative
- Recipient Representative
- Estimated number of records
From the ‘Add New’ dropdown, upload your completed CSV file using ‘Import Third Parties’.
After a successful upload, your data recipient listing will refresh with the new entries added.
TIP: If you do not see a progress bar or new entries after uploading, you may need to refresh your web page when doing multiple uploads after another.
Third Party entry
A Third Party entry in the recipient listing shows some information from the editable recipient profile. It also provides the following functionality.
- One-click updates to contract status: Not signed (red); In progress (yellow); Signed (green)
- Link to DPDx Sharing Guide (additional information and guidelines on the sharing of personal information. We recommend you review your policies and contracts with legal counsel as well.)
- Ability to upload your contract with the third party
- Ability to edit third party profile
- Ability to delete third party
Upload/download Third Party contract
After you have a signed contract, change the Contract Status to ‘Signed’ and upload the contract. You can only have one contract per data recipient.
Once a contract is uploaded, you can also download the current contract. You cannot delete a contract once it has been uploaded.
WARNING: When you upload a new contract, the previous contract is removed and replaced with the most recent upload. The previous contract cannot be recovered.
TIP: If you would like to retain expired/old contracts in DPDx, upload a copy into the “Notes and files” section for the vendor. For visibility and easy access, we also recommend you keep the current contract with the vendor profile using the Upload feature.
View Third Parties listing
The Third Parties listing can be filtered by entering text into the search box. The search is applied to: Recipient, Recipient Type, Country. Filters are cleared by clicking the ‘X’ on the right of the search box.
You can sort the listing alphabetically ascending or descending by clicking on the heading for Recipient, Recipient Type’, ‘Country’, or ‘Renewal Date’.
Edit Third Party
Click ‘Edit’ on the right of the recipient listing to modify the vendor’s profile.
The Edit screen provides three tabs: Details; Data Mapping; Notes and files.
Details
The Details tab allows you to add and edit vendor information. Click Save when your updates are complete.
Data Mapping
The Data Mapping tab shows all of the Personal Information Types that you may provide to this vendor, as defined in your data mapping. There are two tabs based on data classification: Personal Information Types and Special (Sensitive) Personal Information Types.
During your creation of data mapping entries (see steps in ‘New Data Mapping Entry’) you should have checked the data types being processed by this vendor. You can make changes to what is being processed and click Save.
When a Third Party is not used in data mapping, that tab will not appear on the Edit window.
Notes and files
If you have notes and files that are relevant to this vendor, you will add them here.
Notes
Users can add custom notes about a vendor and the contract. Notes cannot be changed or deleted.
Files
Supporting files and documentation may be uploaded. A file named “MyThirdPartyVendor-contract-2023-EXPIRED.pdf” appears with an internal file name. After a file is uploaded, a description may be added or the file may be deleted. You can automatically download a File by clicking on the internal file name.
Delete Third Party
Before deleting a Third Party verify the following:
- Ensure it is not used in your data mappings, as described above in Edit Third Party > Data Mapping
- WARNING: Deleting a Third Party that is currently used in data mappings results in the data recipient being “silently” dropped from Data Mapping > Information Sharing. There are no warnings and you will continue to pass Data Validation. We recommend updating data mapping before vendor deletion.
- Download the most recent contract if you need a local copy
- Download any files attached to the vendor
- Though you cannot download notes, you can copy and paste them into a local document if you need to preserve them.
We recommend creating business processes to manage your Third Party vendor list. Check with your legal counsel for guidance.
