Which of the following is NOT a recommended practice when sharing data with a third-party vendor?

• A. Data-sharing restrictions to minimum necessary
• B. Audit trails of data access
• C. Providing unlimited access for speed
• D. Non-disclosure agreements

Answer: (C)

Controlling access to data is crucial when sharing with a third party. The key idea is to limit access to only what is needed, and to keep track of who can see what and under what terms.

Providing unlimited access for speed goes against this principle. It dramatically increases risk: if credentials are stolen or misused, a wide range of data can be exposed or altered. It also makes it nearly impossible to monitor and enforce what the vendor can do with the data, and it can run afoul of privacy laws and internal governance. In other words, the potential for harm and non-compliance outweighs any time saved.

The other practices support safer sharing. Limiting data to the minimum necessary reduces exposure to sensitive information. Keeping audit trails of data access creates accountability and makes it easier to detect and respond to misuse. Non-disclosure agreements establish legal obligations that govern permissible use and protect confidential information.

So, the option that involves unlimited access is not a recommended practice.