Client data at a supplier: responsibility does not stop at outsourcing

The decision behind the headline

This review focuses on processor security, downstream suppliers, incident cooperation and contractual responsibilities.

For the payroll provider incident, obtain an inventory of what your organisation actually supplied: names, bank information, salary figures and other records. The provider’s public announcement may describe its overall incident without identifying your files. Ask for the relevant period and the available evidence of access or extraction. Keep employee communications grounded in confirmed facts and clearly distinguish what remains under investigation. An outsourced breach can require your own decisions even while another company controls the technical response.

A hypothetical scenario to test

A payroll provider suffers a breach and a small employer must determine which employee records were exposed. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

Review the supplier agreement’s cooperation route, including a named incident contact and information needed for your assessment. Ask whether your insurer provides counsel for the resulting obligations and whether the external provider’s incident fits its outsourced-data terms. Do not conflate possible supplier compensation with your own policy’s eligibility; recovery from another party can involve a separate process. A current data map reduces the time spent reconstructing which records were shared.

Identify the contractual boundary

A supplier incident can expose information even without direct access to your own systems. SRF reported on 30 June 2025 that the Radix attack also affected federal-authority data, while the federal systems had not been directly accessed. This illustrates the dependency, not the terms of any insurance. Distinguish security response, controller and processor responsibilities, client notification and your contractual commitments. Outsourced-data incidents and assumed contractual liabilities should be checked separately in the actual wording; retaining a supplier contract does not prove insurance eligibility. Ask what information you will receive if your provider is attacked: affected data, time window, subprocessors and containment status. Your own risk assessment cannot depend on a generic reassurance. A workable contract should support timely factual cooperation, while notification duties still require situation-specific legal analysis.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of outsourced data incidents, defence costs, contractual assumptions and vendor limits. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to review supplier data handling and require a workable incident escalation mechanism. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare processing contracts, data maps, subcontractor lists and supplier incident notices. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.