An organization requires a third party for processing customer personal data. Which of the following is the BEST approach when sharing data over a public network?

An NDA is a legal agreement that outlines responsibilities and liabilities, but it does not provide technical protection for data transmitted over an insecure public network.

A digital rights protection tool (like DRM or DLP) focuses on controlling and monitoring data usage and access *after* it has been transmitted, not on securing the data during its transfer over a public network.

A Virtual Private Network (VPN) creates an encrypted tunnel over a public network, providing a secure and confidential channel for transmitting sensitive customer personal data to a third party, protecting it during transit.

Transferring a read-only version of the data controls what the recipient can do with the data, but it does not secure the data *in transit* over a public network against interception or tampering.