Businesses both inside and outside the United States might be liable for third-party providers’ actions. For instance, the EU’s GDPR imposes formidable duties of care for the data a company has in its possession, and they hold the company responsible for third parties working with that data on the company’s behalf. Thus, if your organization works with EU residents, your organization must demonstrate competency at vendor risk management.