An organization's privacy policy discloses how data will be used among groups within the organization itself.

With regard to limitation of use, internal disclosure policies override contractual agreements with third parties.

Intermediaries processing sensitive data on behalf of an organization require stricter disclosure oversight than vendors.

When an organization discloses data to a vendor, the terms of the vendor' privacy notice prevail over the organization' privacy notice.