Who is legally liable when a records vendor mishandles PII you outsourced to them?

When you hand personally identifiable information (PII) to a vendor for storage, scanning, destruction, or other records services, a common assumption is that the vendor now “owns” the risk. In practice, liability is usually shared, and the organization that collected the data rarely escapes responsibility.

The general principle: accountability stays with you

Most privacy regimes distinguish between the party that decides why and how data is processed and the party that processes it on that party’s behalf. The first party is generally treated as accountable for the data, even when day-to-day handling is outsourced. Outsourcing a task does not outsource the underlying duty to protect the information.

This means that if a vendor mishandles PII, affected individuals and regulators will often look first to the organization that entrusted the data. You can be held responsible for failing to vet the vendor, for weak contractual safeguards, or for inadequate oversight.

Where the vendor can be liable

Vendors are not immune. Liability can attach to a vendor when it:

• Breaches the contract (for example, ignores required security controls).
• Acts negligently or exceeds the agreed scope of work.
• Violates a statute or regulation that applies to it directly.

Many laws now place direct obligations on service providers, and contracts typically include indemnification clauses that let one party recover losses caused by the other. So both parties can face exposure at the same time, through different legal avenues.

What actually determines the outcome

Three things usually drive who pays:

1. The contract. Clear data-handling terms, security requirements, breach-notification timelines, audit rights, and indemnification language allocate risk before anything goes wrong.
2. Applicable law. Sector and jurisdiction rules (and, for federal systems of records, statutes like the Privacy Act of 1974) define duties and penalties.
3. Reasonable diligence. Whether you vetted the vendor, monitored performance, and could show a documented program of safeguards.

Practical takeaway

Treat vendor selection and contract terms as core privacy controls, not procurement paperwork. Frameworks such as the NIST Privacy Framework can help you map and govern these risks. For deeper background on protecting personal data, see the privacy and PII topic hub.

This is general guidance, not legal advice; consult counsel for your specific situation.