US CCPA Service Provider Contractor and Third Party Contracts

Start by confirming whether the vendor is a service provider or contractor under the CCPA. For those roles, the contract must prohibit selling or sharing personal information, identify the specific business purpose, restrict use to that purpose, require compliance with the CCPA and these regulations, and give the business the right to take reasonable and appropriate steps to check compliance and stop or remediate unauthorized use.

The contract must also require the recipient to notify the business if it can no longer meet its obligations, allow reasonable and appropriate compliance checks and remediation, and require help with consumer requests. Any subcontractor must be bound by a contract that provides the same level of privacy protection. Under the regulations effective January 1, 2026, service providers and contractors must also supply facts and evidence needed for the business's applicable cybersecurity audit and risk assessment, and assist with verifiable consumer requests to access automated decisionmaking technology (ADMT).

A service provider processes personal information for a business under a written contract; a contractor receives personal information made available by the business under the required certification and contract restrictions. Both roles are limited to business purposes and the direct business relationship. A third party is a person that is not the business with which the consumer intentionally interacts in the current interaction, a qualifying service provider, or a contractor.

A third-party contract must identify the limited and specified purposes, require compliance and the same level of privacy protection, permit reasonable and appropriate compliance checks, require notice if the recipient can no longer comply, and allow the business to stop and remediate unauthorized use. A third party without a section 7053 contract may not collect, use, process, retain, sell, or share the personal information the business made available. A compliant contract does not remove a sale or sharing from the consumer's opt-out right.

A service provider or contractor may use personal information for specified regulatory purposes, including the contract's business purposes, compliant subcontracting, certain internal service improvement, security and fraud prevention, and other uses allowed by the regulations. For example, an email provider may analyze interactions to improve the email service, but may not reuse the original customer list to market for another business. Each use must remain reasonably necessary and proportionate and within the applicable restrictions.

Combining personal information from different businesses or from the recipient's own consumer interactions is restricted, subject to specific regulatory exceptions. Cross-context behavioral advertising for another person does not fit the service-provider or contractor role.

Create a recipient record that links the data flow, role analysis, signed agreement, clause map, subprocessors, rights-response method, compliance checks, and reassessment triggers. Procurement should not approve access to personal information until the role and required terms match.

When monitoring finds unauthorized use, apply the contractual stop-and-remediate process and reassess whether past or future disclosures are sale or sharing. Preserve the finding, notice, containment instruction, deletion or correction evidence, affected consumers and flows, reclassification decision, and closure approval.