<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-third-party-data-sharing
description: >-
  Audit third-party data sharing agreements, detect unauthorized data flows
  to external parties, validate Data Processing Agreements (DPAs), and ensure
  compliance with GDPR Art. 28 processor requirements and CCPA service
  provider obligations.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - third-party
  - data-sharing
  - gdpr
  - ccpa
  - dpa
  - art-28
  - processors
  - vendors
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Auditing Third-Party Data Sharing

## Overview

Third-party data sharing introduces significant privacy risk: unauthorized
processing, inadequate security, scope creep beyond contractual boundaries.
GDPR Art. 28 mandates Data Processing Agreements (DPAs) with binding
instructions; CCPA requires service provider contracts limiting data use.
This skill audits vendor data flows, validates DPA coverage, detects
unauthorized sharing via network analysis, and produces compliance reports.

Mode: `[MODE: PRIVACY]` — Third-party risk and data sharing compliance.

## Prerequisites

- Python 3.10+ with `json` modules
- Third-party vendor inventory with data sharing descriptions
- Data Processing Agreements (DPAs) for each processor
- Network traffic logs for external data flow detection
- Privacy policy and data sharing disclosures

## Key Concepts

### GDPR Art. 28 Processor Requirements

| Requirement | Article | Check |
|-------------|---------|-------|
| Written DPA | Art. 28(3) | DPA exists and is signed |
| Processing instructions | Art. 28(3)(a) | Specific processing scope defined |
| Confidentiality | Art. 28(3)(b) | Authorized personnel only |
| Security measures | Art. 28(3)(c) | Technical/organizational measures |
| Sub-processor approval | Art. 28(2) | Prior written authorization |
| Assist with rights | Art. 28(3)(e) | DSAR fulfillment support |
| Deletion on termination | Art. 28(3)(g) | Data return/deletion clause |
| Audit rights | Art. 28(3)(h) | Controller audit access |

### Third-Party Risk Tiers

```python
RISK_TIERS = {
    "critical": "Processes special categories or large-scale personal data",
    "high": "Processes personal data with cross-border transfers",
    "medium": "Processes personal data within EEA",
    "low": "No personal data processing (verified)",
}
```

### Scanning CLI

```bash
# Audit vendor DPA compliance
node scripts/agent.js --action audit-dpa \
  --vendor "Analytics Provider" --dpa /tmp/dpa_analytics.json

# Scan network for unauthorized data sharing
node scripts/agent.js --action scan-network \
  --input /var/log/network.log --allowlist /tmp/approved_vendors.json

# Validate vendor inventory completeness
node scripts/agent.js --action validate-inventory \
  --inventory /tmp/vendor_inventory.json

# Generate third-party sharing report
node scripts/agent.js --action report \
  --inventory /tmp/vendor_inventory.json
```

## Workflow

### Step 1: Inventory All Third Parties

```bash
node scripts/agent.js --action validate-inventory \
  --inventory /tmp/vendor_inventory.json
```

### Step 2: Audit DPA Compliance

```bash
node scripts/agent.js --action audit-dpa \
  --vendor "Analytics Provider" --dpa /tmp/dpa_analytics.json
```

### Step 3: Detect Unauthorized Sharing

```bash
node scripts/agent.js --action scan-network \
  --input /var/log/network.log --allowlist /tmp/approved_vendors.json
```

### Step 4: Generate Compliance Report

```bash
node scripts/agent.js --action report --inventory /tmp/vendor_inventory.json
```

## Verification

- [ ] All third-party processors documented in vendor inventory
- [ ] DPA signed and valid for each processor
- [ ] Processing scope matches actual data sharing
- [ ] Sub-processors disclosed and approved
- [ ] Cross-border transfer mechanisms in place where needed
- [ ] Audit rights contractually guaranteed
- [ ] No unauthorized data flows detected in network analysis
- [ ] Annual vendor review schedule established

## References

- [GDPR Article 28 — Processor Requirements](https://gdpr-info.eu/art-28-gdpr/)
- [GDPR Article 26 — Joint Controllers](https://gdpr-info.eu/art-26-gdpr/)
- [CCPA Service Provider Requirements — Cal. Civ. Code §1798.140(v)](https://oag.ca.gov/privacy/ccpa)
- [EDPB Guidelines 07/2020 on Controller/Processor](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en)
- [ICO Contracts and Liabilities Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/contracts/)
