> It includes liability for any and all data handed off or handled by 3rd parties.

Good. Outsourcing violations, ethical or legal, shouldn't get you off the hook for them.

Besides which, what are you doing handing off stuff that's important to your business without knowing what's being done with it? Not a recipe for success. And if it's not important, then...