A team installs a free website analytics plugin that sends resident interaction data to a vendor, skipping data-processing agreement review. What governance expectation applies?
Select an answer to reveal the explanation.
Short Explanation
“Free” is not the same as “harmless.” If a plugin ships resident clicks to a vendor, it still needs the same privacy and contract look-over as a pricey platform. Price tags do not waive risk.
Full Explanation
Third-party risk management under data governance covers any external processor of organizational data, including no-cost plugins. Data-processing agreements and privacy reviews establish purpose limits, security expectations, and breach duties. Skipping review because a tool is free creates unmanaged exposure.