Organisations must put in place appropriate contractual protections with each of its service providers having access to the customer’s personal information. Specify the service provider’s standard of care and its obligations with respect to the treatment of personal information.
