Data breaches caused by third parties happen all the time. If organizations are not careful in the way they construct their contracts with those vendors, the organization itself could end up being on the hook for far more of the breach liability than it expected. Organizations should be including liability requirements as early as the request for proposal (RFP) stage. Lawyer: “As litigation increases in this area, for risk-conscious organizations, the protections in the service provider contracts are going to become very important””]