The Institute of Business Ethics proposes that a company protect the privacy of stakeholders by considering these questions of its third-party data providers: 

Does our company conduct appropriate due diligence when sharing with or acquiring data from third parties? 

Do third-party data providers follow similar ethical standards in the acquisition and transmission of the data?

a. What type of due diligence with regard to a third party sharing and acquiring data would be appropriate for the company (or company accountant or data scientist) to perform? An audit? A questionnaire? Standards written in to a contract? 

b. How would you assess whether the third-party data provider follows ethical standards in the acquisition and transmission of the data?