Whose Data Is It Once a Vendor Is Holding It?

DATA GOVERNANCE | VENDOR & THIRD-PARTY RISK

Written by: Devensa AI

Figure: Organizations give about 20 vendors network access on average, yet only 50% keep a comprehensive inventory of them, and 47% had a third-party access breach in the past year. Source: Ponemon Institute and Imprivata (2025).¹

Data held by a vendor is still yours to govern: ownership and accountability stay with you even when custody moves. The difficulty is visibility. In Ponemon Institute and Imprivata research, only 50% of organizations keep a comprehensive inventory of vendors with network access, and 47% reported a third-party access breach within a year.¹

Ownership, Custody, and Stewardship Are Three Different Things

Data governance separates questions that contracts often blur. Ownership is who holds rights to the data and answers for it. Custody is who stores and processes it. Stewardship is who is responsible for its quality, classification, and correct use day to day. When a vendor takes custody, ownership and stewardship do not leave with the file. Unless the contract is specific, they simply become harder to exercise.

Vendor data governance is often mistaken for a security topic, handled through encryption clauses and access reviews. Security protects data from the wrong people. Governance decides what the right people, vendors included, may do with it: derive new datasets, combine it with other customers’ data, train models on it, or keep it after the contract ends.

The Blind Spots That Grow With Every Vendor

Derived and aggregated data

Many vendor agreements grant the provider rights to aggregated or de-identified data derived from customer inputs. That derived data can outlive the contract, and definitions of de-identification vary widely between providers.

AI use of shared data

Verizon’s 2026 DBIR found employee use of unapproved shadow AI tripled to 45%, raising data leakage.² Data pasted into an AI tool is, functionally, data handed to another vendor, often with no contract addressing training use. Cisco’s 2026 benchmark found 90% of organizations say AI has expanded their privacy programs.³

Protection that does not travel

IBM’s 2026 Cost of a Data Breach Report found that more than half of breached organizations lacked encryption for sensitive data.⁴ Classification labels and handling rules applied inside your environment frequently disappear at the export step.

Lineage that stops at the boundary

Internal lineage tools show where data came from and where it went, until it crosses into a vendor’s system. From there, copies, backups, and replicas are known only through the vendor’s assurances.

Figure: Three channels that move data beyond a standard vendor agreement: shadow AI use (45%), unencrypted sensitive data (53% of breached organizations), and AI-expanded privacy scope (90%). Sources: Verizon (2026); IBM (2026); Cisco (2026).²⁴³

Accountability does not transfer

Regulators treat the organization that collected the data as answerable for it. DLA Piper counted an average of 443 personal data breach notifications a day across Europe, up 22%.⁵ A breach at a vendor still produces a notification that carries your name. The platform’s vCDO capability, an AI-powered vOfficer augmented by Devensa subject-matter experts where needed, is designed to keep vendor-held datasets visible as governed assets rather than contract line items.

DAMA-DMBOK Extends Past Your Firewall

DAMA-DMBOK places data governance at the center of its knowledge areas, surrounded by disciplines including data architecture, data security, data integration and interoperability, metadata management, data quality, and reference and master data. Each has a vendor dimension. Metadata management means classifications travel with the data. Integration means every vendor feed is a documented interface with an owner. Data quality means vendor-returned data is validated before it re-enters core systems. Data security means handling rules are contractually binding, not advisory.

Devensa AI scores this through TruMaturity™, the methodology and six governance domains shared across Devensa. On the platform, the TruMaturity™ Assessment is designed as an AI-mediated, adaptive assessment, triggered on first sign-in and roughly annually after that, with scores mapped to the five CMMI maturity levels. For vendor-held data, the levels read like this:

• Level 1, Initial: Vendors receive data through ad hoc exports, with no record of what went where.
• Level 2, Managed: Contracts include data clauses, but no one tracks vendor-held datasets.
• Level 3, Defined: A register of vendor-held data records owner, steward, classification, permitted uses, and retention.
• Level 4, Quantitatively Managed: Vendor feeds are monitored for volume, fields, and quality against defined thresholds.
• Level 5, Optimizing: Sharing terms are revised as uses evolve, and exits include verified deletion.

Keeping Ownership Real

1. Register vendor-held data as a data asset. Give each vendor-held dataset an internal owner and steward, as you would an internal system.
2. Define derived-data rights in writing. State whether the vendor may create aggregated, de-identified, or model-training derivatives, and what happens to them at exit.
3. Send classification with the data. Put classification and handling requirements in the interface specification, not only in the contract.
4. Validate what comes back. Apply the same quality rules to vendor-returned data as to internal sources.
5. Certify the exit. Require a written deletion certificate covering primary copies, backups, and sub-processor copies.

Frequently Asked Questions

Who owns data when a vendor stores it?

The organization that provided the data generally retains ownership and accountability, subject to the contract. The vendor holds custody and whatever usage rights the contract grants, which is why those rights need to be specific.

Can a vendor use our data to train its AI models?

Only if the contract or terms permit it. Some providers enable training use by default unless a customer opts out, so both the setting and the contract language deserve review.

What is derived data, and who owns it?

Derived data is created from your inputs: aggregates, analytics, scores, or model weights. Ownership depends on the contract. Without explicit terms, vendors often assert rights to aggregated or de-identified derivatives.

How do we confirm deletion at contract end?

Require a deletion certificate naming the systems covered, including backups and sub-processors, with a timeline for backup expiry. For sensitive data, request evidence rather than a simple attestation.

Who should steward vendor-held data?

The same business data steward who governs the dataset internally, supported by the data governance office. If a vendor holding your customer data were acquired tomorrow, who would know which datasets went with it?

Sources

1.  Ponemon Institute and Imprivata, “The State of Third-Party Access in Cybersecurity” (2025), report infographic. https://www.imprivata.com/sites/imprivata/files/2025-06/3214-2025_Ponemon%20TPA%20report%20Infographic.pdf

2.  Verizon, “Breach entry point, 2026 DBIR finds” (2026 Data Breach Investigations Report news release, May 19, 2026). https://www.verizon.com/about/news/breach-industry-wide-dbir-finds

3.  Cisco, 2026 Data and Privacy Benchmark Study (2026). https://www.cisco.com/c/en/us/about/trust-center/data-privacy-benchmark-study.html

4.  IBM and Ponemon Institute, Cost of a Data Breach Report 2026, key findings as reported by eSecurity Planet (July 30, 2026). https://www.esecurityplanet.com/cybersecurity/ibm-2026-cost-of-a-data-breach-report-key-findings/

5.  DLA Piper, GDPR Fines and Data Breach Survey: January 2026. https://www.dlapiper.com/en-us/insights/publications/2026/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2026

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.