{ "name": "Venbix Third Party Risk Obligations", "title": "Third Party Risk Obligations", "url": "https://venbix.com/datasets/third-party-risk-obligations/", "csv": "https://venbix.com/datasets/third-party-risk-obligations.csv", "markdown": "https://venbix.com/datasets/third-party-risk-obligations/index.md", "computed_at": "2026-10-18", "license": "https://venbix.com/terms", "headline": "The Third Party Risk Obligations carries 2 published figures read from 2 sources' own pages, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.", "quotes": [ "The Third Party Risk Obligations carries 2 published figures read from 2 sources' own pages, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.", "2 of the 16 named sources read in full publish a figure; 14 publish none, read 17 October 2026.", "Third Party Risk Obligations, obligation critical ICT provider representation window: median 6 week across 1 source, read 17 October 2026.", "Third Party Risk Obligations, obligation personal data retention limit: median 15 year across 1 source, read 17 October 2026.", "Third Party Risk Obligations, obligation maximum administrative fine, lower tier: median 10,000,000 EUR across 1 source, read 17 October 2026.", "Third Party Risk Obligations, obligation maximum administrative fine, higher tier: median 20,000,000 EUR across 1 source, read 17 October 2026." ], "citation": "\"Venbix Third Party Risk Obligations\", updated 2026-10-18, https://venbix.com/datasets/third-party-risk-obligations/.", "changed_since": null, "national": { "unit": "EUR", "n": 2, "median": 15000000, "min": 10000000, "max": 20000000, "p25": null, "p75": null, "mean": 15000000, "units": { "EUR": 2, "week": 1, "year": 1 }, "published_sources": 2, "named_sources": 16, "read_sources": 16, "not_published": 14, "published_share": 0.125 }, "by_axis": { "obligation": { "critical ICT provider representation window": { "week": { "n": 1, "median": 6, "min": 6, "max": 6, "p25": 6, "p75": 6, "mean": 6 } }, "personal data retention limit": { "year": { "n": 1, "median": 15, "min": 15, "max": 15, "p25": 15, "p75": 15, "mean": 15 } }, "maximum administrative fine, lower tier": { "EUR": { "n": 1, "median": 10000000, "min": 10000000, "max": 10000000, "p25": 10000000, "p75": 10000000, "mean": 10000000 } }, "maximum administrative fine, higher tier": { "EUR": { "n": 1, "median": 20000000, "min": 20000000, "max": 20000000, "p25": 20000000, "p75": 20000000, "mean": 20000000 } } } }, "rows": [ { "source": "DORA (Regulation (EU) 2022/2554) on EUR-Lex", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554", "figure": "6 weeks", "value": 6, "unit": "week", "vat": null, "axis": { "obligation": "critical ICT provider representation window" }, "retrieved_at": "2026-10-17", "quote": "Within 6 weeks from the date of the notification, the ICT third-party service provider may submit to the Lead Overseer a reasoned statement with any relevant information for the purposes of the assessment.", "source_class": "primary-government", "text_sha256": "3466a52ea285c4601e62a72b6c1ac4e92f346bb716d8ea850ec4d3c52a219dc1" }, { "source": "DORA (Regulation (EU) 2022/2554) on EUR-Lex", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554", "figure": "15 years", "value": 15, "unit": "year", "vat": null, "axis": { "obligation": "personal data retention limit" }, "retrieved_at": "2026-10-17", "quote": "Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data.", "source_class": "primary-government", "text_sha256": "3466a52ea285c4601e62a72b6c1ac4e92f346bb716d8ea850ec4d3c52a219dc1" }, { "source": "GDPR (Regulation (EU) 2016/679) on EUR-Lex", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679", "figure": "10 000 000 EUR", "value": 10000000, "unit": "EUR", "vat": null, "axis": { "obligation": "maximum administrative fine, lower tier" }, "retrieved_at": "2026-10-17", "quote": "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" }, { "source": "GDPR (Regulation (EU) 2016/679) on EUR-Lex", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679", "figure": "20 000 000 EUR", "value": 20000000, "unit": "EUR", "vat": null, "axis": { "obligation": "maximum administrative fine, higher tier" }, "retrieved_at": "2026-10-17", "quote": "Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.", "source_class": "primary-government", "text_sha256": "fa473b93c2522022a96584655dee7da55f56ad042925828981dca30bd5af49cc" } ], "not_published": [ { "source": "OCC Bulletin 2023-17: Interagency Guidance on Third-Party Relationships", "url": "https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Federal Register: Interagency Guidance on Third-Party Relationships (88 FR 37920)", "url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "Federal Reserve FRRS: Interagency Guidance on Third-Party Relationships", "url": "https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "FFIEC IT Handbook: Outsourcing Technology Services", "url": "https://ithandbook.ffiec.gov/it-booklets/outsourcing-technology-services/", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "FCA Handbook SYSC 8.1 (outsourcing)", "url": "https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "FCA: outsourcing and operational resilience", "url": "https://www.fca.org.uk/firms/outsourcing-and-operational-resilience", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Bank of England PRA SS2/21: Outsourcing and third party risk management", "url": "https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "EBA Guidelines on outsourcing arrangements", "url": "https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-outsourcing-arrangements", "retrieved_at": "2026-09-19", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS: HIPAA business associates", "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices", "url": "https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "OSFI Guideline B-10: Third-Party Risk Management (Canada)", "url": "https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" }, { "source": "PCI Security Standards Council: PCI DSS", "url": "https://www.pcisecuritystandards.org/standards/pci-dss/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "FDIC press release PR-23-47: final interagency guidance", "url": "https://www.fdic.gov/news/press-releases/2023/pr23047a.pdf", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "OFAC: A Framework for OFAC Compliance Commitments", "url": "https://ofac.treasury.gov/media/16331/download?inline", "retrieved_at": "2026-09-19", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html", "label": "OCC Bulletin 2023-17: Interagency Guidance on Third-Party Relationships", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management", "label": "Federal Register: Interagency Guidance on Third-Party Relationships (88 FR 37920)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm", "label": "Federal Reserve FRRS: Interagency Guidance on Third-Party Relationships", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ithandbook.ffiec.gov/it-booklets/outsourcing-technology-services/", "label": "FFIEC IT Handbook: Outsourcing Technology Services", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html", "label": "FCA Handbook SYSC 8.1 (outsourcing)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.fca.org.uk/firms/outsourcing-and-operational-resilience", "label": "FCA: outsourcing and operational resilience", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss", "label": "Bank of England PRA SS2/21: Outsourcing and third party risk management", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-outsourcing-arrangements", "label": "EBA Guidelines on outsourcing arrangements", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554", "label": "DORA (Regulation (EU) 2022/2554) on EUR-Lex", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679", "label": "GDPR (Regulation (EU) 2016/679) on EUR-Lex", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html", "label": "HHS: HIPAA business associates", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final", "label": "NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline", "label": "OSFI Guideline B-10: Third-Party Risk Management (Canada)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.pcisecuritystandards.org/standards/pci-dss/", "label": "PCI Security Standards Council: PCI DSS", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.fdic.gov/news/press-releases/2023/pr23047a.pdf", "label": "FDIC press release PR-23-47: final interagency guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ofac.treasury.gov/media/16331/download?inline", "label": "OFAC: A Framework for OFAC Compliance Commitments", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 16 named sources that could be read published a usable figure; 14 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in EUR (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 2 figures, never sentences; 11 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per life-cycle stage (planning, due diligence, contract, monitoring, termination) with the obligation quoted verbatim from the supervisor's own page and its effective date; the derivation is the CROSS-REGIME comparison nobody publishes - which of the fourteen regimes read here require a written agreement, a register of third parties, an exit plan, a right to audit, sub-contractor consent and breach notification, and the shortest notice each allows - plus changed-since on every re-read", "embed": "

10,000,000 to 20,000,000 EUR

2 published figures, Third Party Risk Obligations, across 2 sources, read 17 October 2026

Source: Venbix Third Party Risk Obligations
" }