Match the written agreement to the recipient role, limited and specified purposes, use and combination restrictions, consumer-request cooperation, security, oversight, notification, remediation, and subcontractor duties.
Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.
Structured answer sets in this page tree.
Cited legal and guidance references.
Classify each recipient from its contract and actual processing. A processes personal information for a business under a compliant written contract; a receives information under the statute's certification and contract conditions; and a is outside those restricted roles. The classification controls permitted uses, consumer-right cooperation, oversight, and whether a disclosure may be a sale or sharing.
Start by confirming whether the vendor is a or under the CCPA. For those roles, the contract must prohibit selling or sharing personal information, identify the specific business purpose, restrict use to that purpose, require compliance with the CCPA and these regulations, and give the business the right to take reasonable and appropriate steps to check compliance and stop or remediate unauthorized use.
The contract must also require the recipient to notify the business if it can no longer meet its obligations, allow reasonable and appropriate compliance checks and remediation, and require help with consumer requests. Any subcontractor must be bound by a contract that provides the same level of privacy protection. Under the regulations effective January 1, 2026, service providers and contractors must also supply facts and evidence needed for the business's applicable cybersecurity audit and risk assessment, and assist with verifiable consumer requests to access ADMT.
A processes personal information for a business under a written contract; a receives personal information made available by the business under the required certification and contract restrictions. Both roles are limited to business purposes and the direct business relationship. A is a person that is not the business with which the consumer intentionally interacts in the current interaction, a qualifying service provider, or a contractor.
A third-party contract must identify the limited and specified purposes, require compliance and the same level of privacy protection, permit reasonable and appropriate compliance checks, require notice if the recipient can no longer comply, and allow the business to stop and remediate unauthorized use. A without a section 7053 contract may not collect, use, process, retain, sell, or share the personal information the business made available. A compliant contract does not remove a sale or sharing from the consumer's opt-out right.
A or may use personal information for specified regulatory purposes, including the contract's business purposes, compliant subcontracting, certain internal service improvement, security and fraud prevention, and other uses allowed by the regulations. For example, an email provider may analyze interactions to improve the email service, but may not reuse the original customer list to market for another business. Each use must remain reasonably necessary and proportionate and within the applicable restrictions.
Combining personal information from different businesses or from the recipient's own consumer interactions is restricted, subject to specific regulatory exceptions. Cross-context behavioral advertising for another person does not fit the service-provider or role.
Create a recipient record that links the data flow, role analysis, signed agreement, clause map, subprocessors, rights-response method, compliance checks, and reassessment triggers. Procurement should not approve access to personal information until the role and required terms match.
When monitoring finds unauthorized use, apply the contractual stop-and-remediate process and reassess whether past or future disclosures are sale or sharing. Preserve the finding, notice, containment instruction, deletion or correction evidence, affected consumers and flows, reclassification decision, and closure approval.
This US CCPA guide turns Service Provider Contractor and Third Party Contracts into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Service Provider Contractor and Third Party Contracts into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Require the service provider or contractor to enable the business to comply with consumer requests made pursuant to the CCPA"
"Prohibit the service provider or contractor from selling or sharing personal information it collects pursuant to the written contract with the business."
"A service provider or contractor shall not retain, use, or disclose personal information collected pursuant to its written contract with the business except for the following purposes, provided that the retention, use, or disclosure is reasonably necessary and proportionate for those purposes."