Vendors Data Sharing and Transactions

This hub covers what happens when data leaves the organization that collected it. It starts with processing roles: distinguishing processors from controllers and independent third parties by the actual processing relationship, with TDPSA duties, data processing agreements, subprocessor and AI-vendor flow-down clauses, security and notice contracts, data location and foreign access, actual onward use, sharing and monetization controls, attestations, audits, and vendor exit triggers. Data licenses and transactions separate possession, access authority, intellectual property rights, contractual licenses, confidentiality, privacy, and reuse permissions, covering APIs, acquired datasets, derived outputs, industrial and operational data, M and A diligence, bankruptcy and successor use limits with the 23andMe genomic sale as the standing scenario, de-identified versus pseudonymized assets, nonpublic data and trade secrets, and CFIUS review where a transaction involves sensitive datasets, plus the EU Data Act for a Texas business with the necessary nexus. Vendor exit, portability, and migration distinguish consumer portability rights from contractual enterprise export rights and cover usable formats, source context, dependencies, credentials, logs, retained copies, subprocessor termination, localization and foreign access restrictions, data map reconstruction, exit evidence, legal holds, and deletion attestations. Marketing covers Texas solicitation law and SB 140 alongside the TCPA, FCC consent and revocation rules, CAN-SPAM, ROSCA and automatic-renewal issues, messaging opt-outs, consent revocation and records, and DTPA representations, without assuming every channel carries the same obligations. A brief recording and vendor-data bridge covers Texas recording law and links to the AI site's specialized notetaker treatment.

Key questions

What changes when a vendor uses data for its own purposes
How should data assets transfer in an acquisition or bankruptcy
What must a vendor exit plan cover
Which consent rules govern marketing calls, texts, and email
When does sharing data become a sale under Texas law

Controlling authorities

TDPSA controller, processor, and third-party provisions; Texas solicitation law and SB 140; the federal TCPA; FCC consent and revocation rules; CAN-SPAM; ROSCA (pinpoints for the federal marketing statutes are research leads for drafting); Texas recording law (Penal Code provisions on interception; exact pinpoint is a research lead).

Guides in this hub

Planned insights

I09 Why Foreign Vendor Access Belongs in the Data Map (the DOJ program, PADFAA, counterparties, remote access, and legally distinct regimes); candidates from the bank: marketing and consent changes; data de-identification and monetization.

Tracker records

K07 Texas data-broker registration and registry
K43 DOJ Data Security Program 28 CFR part 202
K44 PADFAA and FTC broker enforcement materials
K53 EU Data Act and operative implementation
K65 CFIUS review of transactions involving sensitive personal data
RK002 Texas Data Broker Law
RK012 telemarketing and text messages
RK046 23andMe bankruptcy
RK053 Protecting Americans' Data from Foreign Adversaries Act of 2024
RK054 DOJ Data Security Program, 28 C.F.R. part 202
RK057 FCRA, VPPA, ECPA, Stored Communications Act, CLOUD Act, and TCPA
RK063 FCC clarifications to the TCPA "revoke all" consent rule and CAN-SPAM
RK064 ROSCA (automatic renewals and negative-option marketing).