## 1 Introduction  
Organisations are increasingly engaging in collaboration with third-party entities such as vendors, suppliers, and business partners to leverage data collection and analysis for improved decision making and operational efficiency [1]. These partnerships allow access to specialised knowledge and resources, facilitating efficient data analytics and cost-effectiveness compared to developing in-house capabilities. Data sharing, a practice vital for knowledge growth and informed decision making, is prevalent across organisations regardless of their resources or technology. It is particularly significant in Internet of Things (IoT) contexts, where data exchange between devices and systems is key to enabling smart, connected environments. While organisations already benefit from using consumer data, further advantages can be gained by sharing data with external entities. This is evident in the growing importance of data sharing for businesses, especially in online social networking platforms like LinkedIn, Facebook, and X (previously known as Twitter), where user data are shared across various communities [2]. However, despite the benefits associated with sharing data with third-party entities, these organisations pose privacy risks to individuals who use their services. This is because these organisations collect, analyse, and share individuals' data, which often includespersonally identifiable information (PII) and sensitive data. Consequently, these data-sharing activities raise privacy concerns, as many organisations exploit data for marketing purposes by delivering targeted advertisements and other content [3]. For example, Google collects extensive user data across its platforms, such as maps and YouTube, for targeted advertising. While it is part of Google's business model to collect data about its users, it has raised concerns about privacy, as individuals may not be fully aware of the extent of the data collected or how it is used. The personal data exchange between primary organisations and their third-party partners significantly raises the risk of privacy breaches. This issue is supposedly addressed by privacy regulations and industrial privacy frameworks. However, a critical problem lies in the existing privacy regulations, which, while mandating organisations to comply with legal standards and enforce privacy policies, often lack specificity in their guidelines. These regulations typically focus more on legal compliance and general privacy protection rather than providing detailed, technical directives essential for robust data protection. For example, organisations are required to disclose how they collect, process, and share personal data, but the regulations fall short of offering explicit, technical instructions on implementing these practices securely. Terms like \"Safeguarding\" used in these regulations are often too broad and ambiguous, leaving organisations without clear, actionable steps for effectively protecting personal data, thus creating a gap in practical data protection measures. Consequently, both primary and their third-party collaborators are obligated to lean towards the legal aspects and thus often encounter a lack of agreement between the emphasis on legal compliance outlined in regulations and the lack of technical elements essential for establishing robust data security. This difference can lead to the development of privacy policies that, while legally compliant with the law, may not fully address the complexities of data protection in today's digital world. Another issue can also be the level of data importance in protecting personal data. While all organisations have the responsibility of implementing privacy policy measures to protect and maintain the integrity of personal data, third-party entities collaborating with these organisations may not bear the same level of responsibility. For example, the Facebook-Cambridge Analytica scandal highlights how third-party entities might misuse data due to inadequate privacy protections.