At least for us the protocols in place when that happens are very strict.
If a third party contractor requires information of ours to do the job that we contracted them to do, they might have access on a read-only basis but they don't have the ability to, say, download the information, copy the information or take it off premises. Certainly, we think long and hard before we engage someone from the outside to help us with our work. Once we do make that decision, we ensure that strict policies are in place and that legal and contractual obligations are instituted before anything happens.