Communication to individuals is one of the third-party criteria (7.1.1) requiring that your organization inform individuals that their personal information will be disclosed to third parties only for the purposes identified in the notice. It also requires that the individual has provided implicit or explicit consent for these specific uses of their personal information. Exceptions are allowed where a law or regulation specifically allows or requires otherwise. An important aspect of this communication is the disclosure of any limitations known on the third-party's privacy practices and controls. If your organization does not have any requirements on limitations, then the communication should indicate that the third-party's privacy practices and controls meet or exceed those of the entity.
7.1.2 states that your organization's privacy policies are also communicated to third parties to whom personal information is disclosed. When you supply the third parties with your organization's privacy policies, your organization should obtain a written agreement from the third party that its practices are substantially equivalent to your organizations.