Entity ensures that appropriate remediation measures are in place when personal data is shared with vendors as a part of its processing activities