Vendor DPIA intake form requirements under Arkansas law
You can outsource your data processing, but under Arkansas law, you can never outsource your liability for a vendor’s failure to maintain reasonable security.
In the modern digital ecosystem, sharing data with third-party vendors—cloud providers, payroll processors, marketing agencies—is inevitable. However, for Arkansas businesses, this operational necessity introduces a critical legal vulnerability. The Arkansas Personal Information Protection Act (APIPA) explicitly mandates that businesses must implement and maintain “reasonable security procedures and practices” appropriate to the nature of the information. Crucially, this duty extends to the vendors you hire. If a vendor handling your customers’ Social Security numbers or biometric data gets breached because they were negligent, Arkansas regulators and plaintiffs’ attorneys often look to you for damages, arguing that your selection of that vendor was legally unreasonable.
The “Vendor DPIA” (Data Protection Impact Assessment)—or more accurately in Arkansas, a Vendor Risk Assessment Intake Form—is your primary shield against this derivative liability. It is not merely a questionnaire; it is a deposition of your vendor’s security posture before the contract is signed. It forces the vendor to go on record regarding their encryption standards, data destruction policies, and incident response timelines. Without this documented intake process, you are essentially handing your data to a stranger without verifying if they have a lock on their door.
This article provides a blueprint for constructing a Vendor DPIA Intake Form tailored to Arkansas law. We will move beyond generic GDPR templates to focus on the specific triggers in the Arkansas Code—such as the “retention and destruction” mandate and the specific definition of Personal Information (PI) that includes medical and biometric data. You will learn how to turn a bureaucratic form into a rigorous filter that disqualifies risky partners before they can infect your ecosystem.
Critical checkpoints for your Arkansas Vendor Intake:
- The Encryption Test: Does the vendor encrypt data at rest and in transit? (This is your primary Safe Harbor under Arkansas law).
- The Destruction Warrant: Does the vendor certify compliance with Ark. Code § 4-110-104(a) regarding the shredding or erasing of records no longer needed?
- Incident Response Speed: Can the vendor guarantee notification to you within 24-48 hours of a breach, allowing you to meet the “most expedient time” state standard?
- Biometric Handling: If sharing fingerprints or facial geometry, does the vendor have specific retention protocols aligned with the 2019 amendments?
See more in this category: Digital & Privacy Law
In this article:
Last updated: October 26, 2023.
Quick definition: A standardized internal document used to evaluate the privacy risks and security controls of a third-party vendor before granting them access to Arkansas residents’ Personal Information.
Who it applies to: Any business (regardless of location) that licenses, owns, or maintains personal information of Arkansas residents and shares it with service providers.
Time, cost, and documents:
- Timing: Must be completed before contract signature or data transfer.
- Cost: Internal compliance hours; potential external audit fees.
- Key Documents: Intake Form, Vendor Security Addendum (DPA), SOC 2 Report.
Key takeaways that usually decide disputes:
Further reading:
- Proof of “due diligence” in vendor selection.
- Specific contractual requirements for data destruction (Ark. Code § 4-110-104).
- Clear definition of “breach” triggers and reporting timelines.
Quick guide to Vendor Risk Assessment in Arkansas
- It’s About “Reasonableness”: Arkansas law doesn’t define “perfect” security. It demands “reasonable” procedures. The Intake Form is your proof that you acted reasonably by asking the right questions.
- Focus on the Definition of PI: Ensure your form asks specifically about Medical Information and Biometric Data, as these are protected categories in Arkansas that carry higher risk profiles.
- The “Red Flag” Rule: If a vendor refuses to answer questions about encryption or past breaches, that is a red flag. Proceeding anyway constitutes negligence.
- Contractual Binding: The answers in the Intake Form should not just be informational; they should be referenced in the final contract. If they lie on the form, it becomes a breach of contract.
- Data Destruction is Mandatory: Unlike some states that only focus on active security, Arkansas specifically mandates proper destruction of records. Your form must verify the vendor has the capability to “shred, erase, or otherwise modify” data to make it indecipherable.
Understanding the Vendor DPIA in practice
While the term “DPIA” (Data Protection Impact Assessment) is borrowed from the European GDPR, the concept is fundamental to complying with US state laws like Arkansas’s. In Arkansas, the legal requirement is framed as a duty to implement “reasonable security procedures.” When you hand data to a vendor, you are extending your security perimeter. If that extension is weak, the law views it as your failure. The Intake Form is the operational mechanism to bridge the gap between your internal policy and the vendor’s actual practices.
The operational reality is that marketing or HR departments often want to onboard a new tool “yesterday.” They view security reviews as a bottleneck. The Intake Form serves as a structured gatekeeper. It shifts the burden of proof to the vendor. Instead of your security team chasing down details, the vendor must affirmatively state their controls. This document then becomes Exhibit A in any future litigation, demonstrating that you performed due diligence and did not negligently entrust sensitive data to a non-compliant entity.
The “Safe Harbor” logic in the Intake Form:
- Encryption Verification: Arkansas breach notification law exempts encrypted data (if the key is not stolen). Your form must ask: “Is data encrypted at rest? Which standard (AES-256)?” A “Yes” here significantly lowers your legal risk.
- Destruction Capability: Ask: “Do you have an automated process to permanently delete data upon contract termination?” This aligns directly with § 4-110-104(a).
- Insurance Coverage: “Do you carry Cyber Liability Insurance?” This ensures that if they cause a mess, there are funds available to clean it up, protecting your bottom line.
- Sub-processor Visibility: “Do you outsource to others?” You need to know if your data is being passed down a chain of unknown entities.
Legal and practical angles that change the outcome
The Scope of Data is the variable that changes the outcome of the assessment. An intake form for a vendor handling a marketing email list (low risk) should not be the same as one for a vendor processing employee payroll (high risk). Arkansas law places a premium on SSNs, financial account info, and medical/biometric data. A “smart” intake form uses branching logic: if the business user selects “Yes” to “Does this vendor access SSNs?”, the form should trigger a deeper set of questions regarding encryption keys and access logs. Treating all vendors with the same heavy-handed questionnaire leads to “compliance fatigue” and internal bypassing of the process.
Another practical angle is Audit Rights. A vendor might claim on the form that they have “world-class security.” But do they allow you to verify it? The Intake Form should establish whether they will provide a SOC 2 Type II report annually or allow a third-party penetration test. In the event of a breach, the difference between “we took their word for it” and “we reviewed their annual audit” is the difference between negligence and reasonableness.
Workable paths parties actually use to resolve resistance
Vendors, especially large SaaS providers (like Salesforce or Microsoft), will not fill out your custom 50-page spreadsheet. They will send you their standard “Security Package” or refer you to their “Trust Center.” The workable path here is to accept their standard documentation provided it answers your core questions. Your intake process should have a track for “Standard Packet Review” where a security analyst maps their provided docs to your requirements. For smaller vendors who don’t have these packages, the full Intake Form is mandatory and non-negotiable.
Practical application: Designing the Intake Workflow
Do not create a static PDF. Use a digital workflow (Microsoft Forms, ServiceNow, OneTrust) that routes based on answers.
- Business Context (The “Why”): The internal business owner fills this. What is the tool? Why do we need it? What is the volume of records?
- Data Classification (The “What”): Specific checklist against Arkansas PI definitions. “Will this involve SSNs, Driver’s Licenses, Medical info, Biometrics, or Financial Account numbers?”
- Vendor Security Self-Assessment (The “How”): The vendor answers.
- “Describe encryption methods in transit/at rest.”
- “Have you had a security breach in the last 3 years?”
- “Describe your data destruction methodology.”
- Risk Scoring: The security/privacy team assigns a score (High/Med/Low). High risk requires a signed Data Processing Addendum (DPA) and potentially higher insurance limits.
- Remediation: If the vendor lacks a control (e.g., no multi-factor authentication), can we implement a compensating control (e.g., single sign-on restricted to our VPN)?
- Approval & Contract: The assessment is attached to the contract record. The contract includes a clause mandating adherence to the security standards claimed in the assessment.
Technical details and relevant updates
The technical heart of the Arkansas requirement is Ark. Code Ann. § 4-110-104(a), which governs the destruction of records. It states that a business must take “all reasonable steps to destroy or arrange for the destruction of a customer’s personal information… by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable.” Your intake form must specifically query the vendor’s technical ability to meet this “unreadable or undecipherable” standard. Simple “deletion” (which often just removes the pointer to the file) may not be enough; forensic erasure or crypto-shredding is the preferred standard.
Relevant to the 2019 Amendments (Act 1030), the definition of Personal Information was expanded to include Biometric Data. If your vendor provides time-clock software (fingerprint) or facial recognition security, your Intake Form must specifically ask about biometric retention schedules. Arkansas law is not as aggressive as Illinois (BIPA), but the inclusion of biometrics in the breach notification statute means the risk profile is elevated.
- Incident Response Window: While Arkansas uses “most expedient time,” your contract should technically bind the vendor to report to you within 24-72 hours so you have time to assess.
- Liability Caps: Watch out for vendors trying to cap liability at “12 months of fees” for data breaches. This is often insufficient to cover the cost of notifying 100,000 Arkansas residents.
Statistics and scenario reads
Third-party breaches are the dominant vector for data exposure today. Understanding the failure points in the vendor relationship helps prioritize the questions in your Intake Form.
Data indicates that while direct hacks of companies are common, breaches occurring via a “trusted vendor” (supply chain attacks) are more costly and take longer to detect because the victim assumes the vendor is secure.
55%
Majority of data exposures now originate in the supply chain.
30%
Attacks directly against the primary entity’s infrastructure.
15%
Employee negligence or malicious intent.
Monitorable points for vendor management:
- SOC 2 Status: % of high-risk vendors with current audit reports (Target: 100%).
- DPA Signature Rate: Days to get the Data Processing Addendum signed (Indicator of negotiation friction).
- Re-assessment Cycle: % of vendors reviewed annually (Don’t just assess at onboarding; risk changes).
Practical examples of Vendor Intake scenarios
Scenario A: The Diligent Health Tech
A Little Rock clinic wants to hire a cloud fax vendor. The Intake Form identifies that the vendor will handle “Medical Information” (High Risk). The clinic requires the vendor to produce a HITRUST certification or SOC 2 report. The vendor complies.
Outcome: The clinic signs the contract with a specific addendum regarding Arkansas breach notification timelines. When the vendor has a minor incident, they notify the clinic in 24 hours. The clinic is protected because they exercised reasonable care in selection.
Scenario B: The “Fast Track” Failure
A retailer rushes to hire a new email marketing firm. They bypass the Intake Form because “it’s just emails.” Later, it is discovered the vendor also stored customer purchase history and credit card tokens in plain text. The vendor is breached.
Outcome: The retailer is sued. The plaintiff argues the retailer failed to maintain “reasonable security” by hiring a vendor with zero encryption standards. The retailer has no intake form to prove due diligence and faces maximum liability.
Common mistakes in Vendor Intake Forms
Making it “One Size Fits All”: Sending a 200-question banking-grade security questionnaire to a vendor who only delivers catering. This destroys compliance culture.
Ignoring Data Destruction: Failing to ask how and when data will be deleted. This leads to “zombie data” living on vendor servers for years, waiting to be breached.
Accepting “Yes” without Proof: A vendor checking “Yes” to “Do you are secure?” is meaningless. You need a third-party attestation (ISO, SOC, HITRUST) or a detailed explanation.
Forgetting Sub-processors: Vetting the vendor but failing to ask who they hire. Your data might be stored on a cheap, insecure server in a different jurisdiction.
FAQ about Vendor DPIA Intake in Arkansas
Is a “DPIA” explicitly required by Arkansas law?
No statute in Arkansas uses the acronym “DPIA” (unlike GDPR or CPRA). However, Ark. Code § 4-110-104 requires “reasonable security procedures.”
In legal practice, documenting a risk assessment (Intake Form) is the standard method to prove that your security procedures—including vendor selection—were “reasonable” rather than negligent.
Does the form need to be shared with the Attorney General?
Generally, no. It is an internal compliance document. You do not proactively file it with the state.
However, if you suffer a breach and the Attorney General investigates your security practices, this form will be one of the first documents requested to prove you were not negligent.
What if a vendor refuses to fill out the form?
This is a major risk signal. If they are too big (e.g., Google), download their public security whitepapers and attach them to your file. This is your “alternative assessment.”
If they are a small vendor and refuse, you should seriously consider blocking the contract. Their refusal suggests they lack the controls to protect your data.
How often should I reassess a vendor?
Best practice is annually for high-risk vendors (those with SSNs, financial, or health data) and upon contract renewal for others.
Security postures change. A vendor that was secure in 2020 might be failing in 2024. Your assessment must be a living process, not a one-time event.
Does this apply to vendors outside of Arkansas?
Yes. The law protects the residents of Arkansas. If your business holds Arkansas data and sends it to a vendor in India or California, you are still responsible for that data.
You must ensure the vendor meets the security standards required by Arkansas law, regardless of where the vendor sits physically.
What is the specific requirement for data destruction?
Ark. Code § 4-110-104(a) requires taking all reasonable steps to destroy records by shredding, erasing, or otherwise modifying them to make them unreadable.
Your contract and intake form must verify the vendor has the technology and process to achieve this “unreadable” state upon termination.
Can I use a template from another state?
You can use a general template (like a GDPR template) as a base, but you must customize the “Definition of Personal Information” to match Arkansas law.
For example, ensure Biometric Data is included as a trigger, which might not be in older generic templates.
Who should sign off on the intake form?
Ideally, a member of the Information Security or Privacy team should review and approve the risk. The business owner (who wants the vendor) should sign off accepting the residual risk.
Legal should review any red flags to ensure the contract includes necessary indemnification clauses.
What if the vendor is just a consultant with no software?
If they have access to your systems (e.g., a laptop or VPN access), they are a risk. The intake form should focus on their endpoint security (Do they use antivirus? Is their laptop encrypted?).
If they have no access to data or systems, a simplified “No Data Access” declaration is sufficient.
How does encryption affect liability?
Under Arkansas law, if encrypted data is stolen (and the key is safe), it is generally not considered a “breach” requiring notification.
Therefore, ensuring your vendor uses encryption provides a massive liability shield. It turns a potential crisis into a non-event.
References and next steps
- Download the Statute: Read Ark. Code Ann. § 4-110-104 to understand the exact wording of “reasonable security.”
- Map Your Vendors: Create an inventory of all current third parties and classify them by data type (PII vs. Non-PII).
- Update Contracts: Ensure your Data Processing Agreements (DPAs) explicitly reference the data destruction standards of Arkansas law.
Related reading:
- Arkansas Personal Information Protection Act (APIPA) Full Text
- How to read a SOC 2 Report for vendor due diligence
- Data destruction standards: NIST 800-88 vs. Shredding
- Drafting indemnification clauses for data breaches
Legal basis
The requirement for vendor vetting in Arkansas derives from Ark. Code Ann. § 4-110-104 (“Protection of personal information”). Subsection (b) mandates that a person or business that maintains personal information shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
This statutory duty of “reasonable security” implies a duty to ensure that any third party to whom data is disclosed also maintains such security, creating the legal necessity for the Intake Form/Risk Assessment process.
Final considerations
The Vendor DPIA Intake Form is not a bureaucratic hurdle; it is the cornerstone of a defensible security posture in Arkansas. When you require a vendor to document their security controls, you are doing two things: you are filtering out incompetent partners who could ruin your reputation, and you are building a legal fortress of “due diligence” that protects your business if the worst happens. In the eyes of the law, the effort you put into vetting a vendor is directly proportional to the leniency you will receive after a breach.
Do not wait for a breach to start asking these questions. Implement a standardized, tiered intake process today. Whether it is a simple questionnaire for low-risk vendors or a rigorous audit for high-risk partners, the act of asking—and documenting the answer—is what separates a prudent business from a negligent one.
Key point 1: Arkansas law mandates “reasonable security,” which implies vetting any vendor you trust with PI.
Key point 2: Data destruction capabilities must be verified upfront to comply with § 4-110-104(a).
Key point 3: Encryption is the most effective way to reduce breach notification liability.
- Automate the intake process to ensure no vendor is skipped.
- Ensure the “Definition of PI” in your form matches Arkansas law (includes biometrics).
- Bind the vendor’s answers to the final contract.
This content is for informational purposes only and does not replace individualized legal analysis by a licensed attorney or qualified professional.