Third-party Data Management Flashcards

Question 1

What is third-party data, and how does it differ from first-party data?

Accepted Answer

Third-party data is information an organization obtains from an external source that did not collect it directly. First-party data is gathered directly by the organization itself, such as from website activity, purchases, or support records. Because the collector differs, the receiver usually knows less about how the data was gathered.

Question 2

What is a data broker, and what role does it play?

Accepted Answer

A data broker is a company that collects information from many sources, such as public records, transactions, and online activity, then compiles and sells or licenses it to other organizations. Its role is to act as an intermediary between data originators and data buyers. Buyers should verify how the broker sourced its records before relying on them.

Question 3

Why is data provenance important when using externally sourced data?

Accepted Answer

Data provenance is the documented history of where data came from, how it was collected, and how it has been changed since. It matters because the receiving organization must judge whether the data is reliable, lawful to use, and appropriate for its intended purpose. Without provenance records, teams cannot trace errors to their origin.

Question 4

What is a data license, and why must it be reviewed before use?

Accepted Answer

A data license is the legal permission that defines how a licensor allows a licensee to use, store, share, and modify a dataset. It must be reviewed before use because it sets boundaries like permitted purposes, retention periods, and whether derived products may be redistributed. Breaching those terms can create legal and financial risk.

Question 5

What does data lineage describe within a data pipeline?

Accepted Answer

Data lineage describes the path data takes from its source through each transformation, join, and storage step until it reaches a final use. Mapping this path shows which systems touched a record and which downstream outputs depend on it. Teams use lineage to assess the impact of a vendor feed change.

Question 6

What is a data dictionary and why does it matter for vendor data?

Accepted Answer

A data dictionary is a reference document that defines each field in a dataset, including its name, meaning, format, allowed values, and units. For vendor data it matters because external feeds often use codes or labels the receiving team did not create. A clear dictionary prevents misinterpretation of codes.

Question 7

What is the difference between a data owner and a data steward?

Accepted Answer

A data owner is the accountable person who decides how a dataset may be used and who may access it. A data steward is the person who carries out day-to-day tasks such as maintaining definitions, monitoring quality, and enforcing policy. For third-party data, owners approve sourcing decisions while stewards track the vendor feed.

Question 8

Why do organizations maintain an inventory of their third-party data sources?

Accepted Answer

A third-party data inventory is a register listing each external source, its data, the governing contract, the consuming systems, and the responsible business owner. The inventory lets an organization answer basic questions, such as which vendors hold a given data type. Without it, risk reviews and deletion requests become guesswork.

Question 9

What is vendor due diligence in the context of acquiring external data?

Accepted Answer

Vendor due diligence is the process of investigating a data provider before committing to it, examining its data sources, collection methods, business practices, security posture, and financial stability. The goal is to confirm that the provider can supply data that is accurate, lawfully obtained, and suitable for the intended use.

Question 10

Why should buyers ask a data provider how consent was obtained?

Accepted Answer

Buyers should ask because consent determines whether individuals agreed to their information being shared for purposes like the buyer's intended use. If consent was narrow or absent, the buyer may be unable to use the data lawfully, even if it appears accurate. Asking early lets the buyer reject a source before integrating it.

Question 11

What is a sample audit, and how does it support vendor evaluation?

Accepted Answer

A sample audit is a review of a small, representative set of records from a vendor's dataset, compared against original sources or independent checks. It tests whether the vendor's stated accuracy and completeness claims hold in practice. Buyers use sample results to negotiate pricing, request corrections, or decide whether to end the relationship.

Question 12

What should a pilot or trial dataset help a buyer determine?

Accepted Answer

A pilot dataset lets a buyer test a vendor's data on a limited scale before a full purchase. It helps determine whether the fields match the documented schema and whether refresh timing fits operational needs. Record pilot results so the decision rests on evidence, not sales claims.

Question 13

Why is a provider's use of subcontractors relevant to due diligence?

Accepted Answer

Data providers often rely on subcontractors for collection, enrichment, hosting, or processing, and those parties handle the buyer's future data. Due diligence should therefore ask which subcontractors touch the data, where they operate, and what controls they must follow. Without that visibility, the buyer cannot assess risks that sit beyond its direct contract.

Question 14

What red flags during evaluation suggest a data source may be unreliable?

Accepted Answer

Warning signs include vague or missing answers about collection methods, refusal to share sample records, unexplained gaps in coverage, and claims of accuracy with no testing evidence. Frequent field definition changes are also concerning. Any of these should prompt deeper review or a decision to walk away.

Question 15

How should a buyer handle a vendor that cannot document its sources?

Accepted Answer

A buyer should generally decline to use data whose origin cannot be documented, because provenance is the basis for judging legality and accuracy. Options include requiring the vendor to produce source documentation before purchase, limiting use to low-risk purposes while review continues, or excluding the dataset from regulated decisions. Document the decision and its rationale for future audits.

Question 16

What core terms should a data licensing agreement define?

Accepted Answer

A data licensing agreement should define the datasets covered, the permitted purposes, the users and locations allowed to access the data, and the duration of use. It should also state update frequency, delivery method, retention and deletion obligations, and rules for derived data. Ambiguity in any of these areas often causes later disputes.

Question 17

What does a derived data clause in a vendor contract govern?

Accepted Answer

A derived data clause governs whether the buyer may create new information from licensed data, and who owns or may reuse those outputs. It also addresses whether derived outputs must be deleted when the license ends. Silence on this point can leave both parties unsure whether outputs survive termination.

Question 18

What is a data processing agreement, and when is one needed?

Accepted Answer

A data processing agreement is a contract that sets out how a service provider may handle personal information on behalf of the customer, including purpose limits, security measures, subcontractor rules, and assistance with individual requests. One is needed whenever a vendor processes personal information for the buyer rather than for its own independent purposes.

Question 19

Why do audit rights matter in a third-party data contract?

Accepted Answer

Audit rights give the buyer the contractual ability to verify that a vendor is following the agreed terms on security, data handling, and usage. Without them, the buyer must rely on the vendor's own statements. Well-drafted audit clauses typically specify notice periods, scope, who pays for the review, and how findings must be remediated.

Question 20

What is a retention and deletion clause meant to achieve?

Accepted Answer

A retention and deletion clause sets how long a vendor or buyer may keep third-party data and what must happen when that period ends or the relationship terminates. Its purpose is to limit exposure by ensuring data is not kept longer than needed. The clause should say how deletion is confirmed.

Question 21

What are standard contractual protections for data quality and warranties?

Accepted Answer

Common protections include vendor warranties that data is accurate, lawfully collected, and provided with the rights stated in the agreement. Buyers seek service levels for refresh timing, correction procedures with defined response times, and indemnities for claims arising from the vendor's own breach. Terms should be negotiated in proportion to the data's business importance.

Question 22

What is the purpose of a consent record in externally sourced data?

Accepted Answer

A consent record documents that an individual agreed to a specific use of their personal information, along with when, how, and under what notice the agreement occurred. For third-party data, it lets a buyer confirm that the intended use falls within what the individual agreed to. Missing records weaken any claim of permission.

Question 23

How does purpose limitation apply to data acquired from a third party?

Accepted Answer

Purpose limitation means data should be used only for the purposes for which it was collected or lawfully obtained, and not repurposed without a valid basis. For acquired data, the buyer must know the original purpose and confirm that its own intended use is compatible with it. A new use may require fresh review.

Question 24

What is data minimization, and why does it matter for vendor feeds?

Accepted Answer

Data minimization means collecting or retaining only the data fields that are needed for a stated purpose. For vendor feeds, it matters because many providers deliver broad records by default, and the receiving team may be exposed to sensitive attributes it never needs. Filtering fields at ingestion reduces legal risk and breach harm.

Question 25

What are sensitive data categories, and why do they need stricter handling?

Accepted Answer

Sensitive data categories are types of information whose exposure or misuse could cause substantial harm, such as health details, financial account numbers, precise location, or information about protected characteristics. Definitions vary by law and policy, so teams should use their organization's classification scheme. These categories need stricter handling because a mistake can lead to discrimination, fraud, or personal safety risks.

Question 26

What security controls should protect third-party data at rest and in transit?

Accepted Answer

Common controls include encryption of data stored on systems and during transfer, role-based access so staff see only what their work requires, and secure transfer methods such as encrypted file transfer or private connections. Organizations should maintain access logs, separate test and production copies, and apply patching to the systems that hold the data.

Question 27

How does a suppression or opt-out list affect use of third-party data?

Accepted Answer

A suppression or opt-out list records individuals who have declined certain uses, such as marketing contact or sale of their information. Buyers must check incoming third-party records against these lists before use, because a record may be present in a feed even though the individual has withdrawn permission.

Question 28

Why should a vendor's security certifications be verified rather than assumed?

Accepted Answer

A certification or attestation is evidence that an independent assessment occurred at some point, but it may cover only part of a company's operations and may not reflect current conditions. Buyers should check the scope of any report, confirm its date and period covered, and ask how exceptions were addressed. Verification turns a claim into evidence the buyer can rely on.

Question 29

What is a data match rate, and what does a low rate indicate?

Accepted Answer

A match rate is the share of records in a third-party dataset that can be linked to an internal record using shared identifiers or matching logic. A low rate may indicate that identifiers are inconsistent, formatting differs, the vendor's coverage is thin, or the internal data is incomplete.

Question 30

What is entity resolution, and why is it needed for third-party data?

Accepted Answer

Entity resolution is the process of determining which records refer to the same real-world person, company, or product. It is needed for third-party data because external feeds rarely share the buyer's identifiers, so matching relies on names, addresses, and other attributes. Poor resolution merges unrelated people or splits one person across profiles.

Question 31

What is a refresh cadence, and how should it be chosen?

Accepted Answer

A refresh cadence is the schedule on which a vendor updates a dataset, such as weekly or monthly. It should be chosen by matching the data's decay rate with the business need. Fast-changing attributes such as contact details or availability may need frequent updates, while stable reference data may need only occasional refreshes.

Question 32

How can a team detect schema drift in a vendor feed?

Accepted Answer

Schema drift is an unannounced change in a feed's structure, such as renamed fields, altered data types, new codes, or reordered columns. Teams can detect it by validating each incoming file against the expected schema before loading and by alerting when column counts, headers, or value distributions change.

Question 33

What should a third-party data vendor performance scorecard track?

Accepted Answer

A scorecard tracks measures tied to the agreement, including delivery timeliness, completeness, accuracy from sample checks, error and correction turnaround, and responsiveness to support requests. Trends matter more than single results, so the scorecard should show performance over time. Reviewing it at regular intervals gives the buyer evidence for renewal, renegotiation, or exit decisions.

Question 34

How should a team handle a deletion or correction request that affects third-party data?

Accepted Answer

Confirm the requester's identity and request scope first, then locate every copy using inventory and lineage records. Deletions or corrections should be applied across internal systems and, where the contract requires, passed back to the vendor or downstream recipients. Record each step so the response can be shown to auditors.

Question 35

What is a data quality dimension, and name two examples.

Accepted Answer

A data quality dimension is a measurable aspect of data fitness, such as accuracy, completeness, timeliness, consistency, validity, or uniqueness. Accuracy asks whether values reflect reality, while completeness asks whether required fields are populated. Teams often score third-party datasets on several dimensions because a feed can be complete yet outdated.

Question 36

Why should integration tests run before a new vendor feed goes live?

Accepted Answer

Integration tests confirm that the incoming data loads correctly, joins as expected, and does not break downstream reports, models, or customer processes. Running them before go-live prevents bad records from reaching production. Tests should include edge cases such as empty files, duplicate keys, and unexpected null values.

Question 37

What is a join key, and why can third-party data create problems with it?

Accepted Answer

A join key is a field, or combination of fields, used to link records across two tables or datasets. Third-party data can create problems because vendors may use identifiers in different formats, such as padded versus unpadded codes, or may omit the key entirely. Mismatched keys cause silent record loss or incorrect duplication.

Question 38

How should teams monitor third-party data after it is onboarded?

Accepted Answer

Ongoing monitoring combines automated checks with periodic human review. Automated checks track volume changes, null rates, distribution shifts, and failed validations on each load, while periodic reviews compare samples to source documentation and recheck vendor certifications and contract compliance. Alerts should route to named owners with defined response times.

Question 39

What should happen when a vendor stops supplying data or the contract ends?

Accepted Answer

The organization should follow an exit plan that identifies replacement sources or internal alternatives, migrates dependent processes, and sets a deadline for vendor data to be returned or deleted. Downstream reports and models that rely on the feed should be reviewed for gaps. Deletion should be confirmed in writing, consistent with the retention terms.

Question 40

Why is a clear owner needed for each third-party data feed?

Accepted Answer

A named owner is accountable for decisions about the feed, including whether it is renewed, how issues are escalated, and who may use the data. Without one, problems such as failed loads or expired licenses can go unnoticed until they affect customers or audits. Record ownership in the inventory.

Third-party Data Management Flashcards

1Core concepts and terminology

2Sourcing and due diligence

3Contracts and data sharing terms

4Privacy, consent and security controls

5Quality, integration and monitoring

Learning Resources