Businesses of all sizes aren’t paying enough attention to how their partners handle personal data. It’s time to start asking the right questions.