Third-Party Vendor Management Means Managing Your Own Risk: Chapter Nine

Neptune: Terminating a Contractual Relationship

Like Neptune, the termination of a contractual relationship may be overlooked until the end, may happen faster than the speed of sound and may be a rocky event. 

Terminating a contract is not the same as terminating a relationship, yet both may happen given the uncertainty present in business operations. Often, businesses are surprised by factors beyond our control, such as unstable economies, natural disasters, competitor actions, changes within your own company and technological disruptions. While we may hope for predictability, often we must prepare for the worst. At other times, there is simply a failure to meet needs, whether that means service-level commitments on the vendor side or a change in circumstances that changes your needs.

When considering the termination of a vendor relationship, you must consider the vendor, the contract and the business impact. Although this article is aimed at the privacy considerations in terminating a vendor relationship, there are other considerations within a general business frame.

The Vendor

How a relationship with a vendor is terminated depends on the type of vendor in consideration. If this vendor is merely a common provider of toilet tissue, there is generally no angst over termination terms and conditions. If the vendor is a strategic partner, there is likely much more agony and complexity in the termination. Your supply chain alone could add complications that you are hopefully prepared to manage. Additionally, you must account for the relationship between people and departments and the history involved. This is especially important when the vendor is an individual contractor or consultant, of which there are many more considerations than this article will cover.

Your company also impacts this analysis. If you are a small, private business, your relationship with a vendor may be much more personal and carry repercussions that large corporations may not see. Yet the termination may still be necessary for valid reasons. In this, you must consider the tradeoffs: Can you sacrifice quality of service for quality of person? Sometimes having a partner you can trust who delivers a lower caliber product may be more valuable than someone you cannot trust. Perhaps you’d rather invest in their improvement and development than seek another vendor.

Likewise, those considerations and options do come into play for larger businesses. Before terminating for cause, you may be required under your contract to provide an opportunity for the vendor to cure any identified issues. If the vendor is a strategic partner, you might want to invest in itd development, regardless of whether your contract allows you to terminate with cause. This is an important option when the vendor is unique, a technological disrupter or has been a critical player in your service or product offerings.

Also, if the vendor is in another country from your business, terminating a relationship may be more complex than expected. Make sure you understand the legal ramifications of terminating a relationship ahead of time, because there are often some elements you can counter in the contract, keeping in mind that in some countries deference is given to the resident vendor in interpreting that contract.

The Contract

As covered in Chapter 6 on contract provisions, termination should be clearly defined in the contract. (It would have been prudent if your company had already contemplated and clearly defined in the contract if certain types of data mishandling practices would give rise to a contract breach.) Although not every situation can be anticipated, the contract should strike a good balance between “worst possible scenario” and “maintaining an amicable parting.” The contract should provide a process for termination that includes advance notice, penalties if based on convenience or perhaps credits if for cause and managing any data in the vendor’s control. The vendor may have invested heavily in this relationship, which may be a key area of negotiation upon termination. This article will not get into the details of a litigious parting; just keep in mind that it is possible and expensive.

If termination is merely a nonrenewal of services, make sure that you have the time frames appropriately in play. If you have automatic renewals, flag these for review in plenty of time to cancel if necessary. If you need to affirmatively renew, have the contract, input and statements of work compiled to determine if a renewal is desired. Try not to be held hostage by incomplete work under new work agreements without amendment of the master services agreement. Consider termination arrangements every time there is an amendment to the scope of work.  If terminating a contract with a vendor with whom your company has a significant relationship, it is easier to rely on processes that are fairly devised. 

Actions Upon Termination in Relation to Data Protection Should Include:

• If a vendor has access to your network and systems, such access must be revoked;
• Vendor’s return of data to you in a format that is acceptable to you and in a manner that is secure, e.g., if the data is sensitive, you may want to require that it be returned in an encrypted format and via an encrypted channel.

 Alternatively, you can require securely transferring the data to your new vendor with acceptance validation:

• Vendor’s destruction of your data that is still in their possession, in a manner that is secure such that the data cannot be practicably reconstructed, with backup and duplicate data destroyed as well. It is advisable to require a certificate of destruction that confirms the destruction and describes the methods used for destruction. Information that must be retained should maintain the data protection requirements currently in place, or stronger if the applicable laws change during the time of retention.
• Identify the time frames for this retention.
• Require secure destruction and a certificate of such at time.

Have a way to flag this in your system for follow-up when appropriate:

• Contract confidentiality survival clauses; remind them in the termination notice.
• Check if non-competes were agreed upon.
• Verify nondisclosure clauses and applicable items.

The Business Impact

Terminating a contract or relationship has some business impact. Keep in mind that the impact should have some benefits or there would be no reason to terminate. Even if the termination is because your business is experiencing hardships and needs to make budget cuts, there is still a benefit in saving funds. Although we touched on some elements of this topic above, there are other considerations.

Often, terminating a vendor relationship means developing a new vendor relationship. Avoid doing this in an emergency when possible. Establishing the proper terms and making deliberate decisions is difficult when done in less-than-ideal conditions. Try to avoid, also, emotional decisions to terminate, which can be difficult to do in some situations. If there is a conflict or cause for termination, remind your business colleagues that you, too, are likely under a nondisclosure agreement and those reasons should be kept confidential—and the reasons may hurt your business reputation as well.

Terminating a vendor relationship may impact your other business relationships. Some customers may rely on your relationship with a particular vendor. Also, in the privacy world, terminating critical vendors who handle information may figure into your regulatory commitments. For example, in the EU, you may need to disclose who your vendors are to controllers for whom you are the processor and obtain permission to switch sub-processors.

Lastly, it may seem obvious, but do carefully consider not just the direct costs of terminating a vendor or changing vendors but also take into account the indirect costs. These indirect costs may include the impact to your product or service offerings, service-level commitments, operations, loss of knowledge and contractual obligations.

In the end, terminating a vendor relationship may or may not be desired; it carries complexities, costs and efforts. And that, in a perfect world, all would go smoothly. However, we do not operate in a perfect world. Akin to signing a prenuptial agreement, termination clauses seem somewhat adversarial and not necessarily standard in all countries. But like a prenup, if the time arises where the agreement is necessary, you will really be glad you covered all of this in advance.

As privacy professionals, we are expected to maintain a high degree of suspicion—somewhat inherent in our positions—that at some point, something will go wrong and a relationship will need to be terminated. This may not necessarily apply to privacy-affiliated professionals such as data engineers, marketers, etc., but learning to maintain a larger awareness of how to prepare for such complications benefits all involved with termination situations. We must plan for terminations and ensure that the data remains protected and our obligations to that data are honored with a contingency process already in place.

photo credit: New York Hot Dog Cart, NY via photopin (license)