Third Party Disclosure Configuration

With the passage of Oregon Consumer Privacy Act, the Minnesota Consumer Data and Privacy Act, and the Delaware Personal Data Privacy Act, businesses in those states must provide consumers with a list of third parties with whom they share consumer data starting July 2024 for Oregon, January 2025 for Delaware, and July 2025 for Minnesota.

Definition of a Third Party

A third party is a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. Vendors with a data processing agreement, such as a third-party SaaS tool, are exempt from third-party disclosure.

The Delaware Personal Data Privacy Act only requires organizations to disclose categories of third parties, not specific names.

EXAMPLES

Public agencies, public authorities, business partners, social media networks, advertising companies (behavioral advertising), and entities during a merger, acquisition, or insolvency.

Managing Third Parties in DataGrail

DataGrail is able to help you manage a list of third parties. This list can be governed on the application's settings page and used in DataGrail's email templates for third-party disclosures. The list will update every time it is saved, and the custom email template sent to the Data Subject will dynamically pull third parties at the time of processing.

1. Navigate to Settings

2. Select Third-Party Disclosures

3. Add third parties in the text box. Each line will be a new bullet point. Optionally, select Add List of Systems or Add List of Integrations to pull integration and system names from your DataGrail System Inventory and Integration list.

4. Once the list of third parties has been added, click Save List. This information will be utilized in a variable as part of the custom email template, triggered when a request is processed.

Delaware and Oregon

If you are subject to both Delaware and Oregon laws, your third party disclosure list should include the names of third parties. Organizations only subject to Delaware regulations just need to disclose categories of third parties. Third-party lists should be reviewed by legal counsel.

Email Templates

The Email Template for processing a third-party disclosure request is named Third Party Disclosure Request Results, and the %third_party_disclosure% variable is used to send your list of third parties to the Data Subject.

This Email Template can be modified in your DataGrail settings page.