US CPRA Contract Terms

Classify the recipient from the actual data flow, not its job title or the agreement's label. A service provider processes personal information for a business under a written contract; a contractor receives information for a business purpose and makes the required certification; a third party is a recipient that does not qualify for an applicable exclusion. If the arrangement does not meet the service-provider or contractor requirements, a disclosure may be a sale or sharing unless another statutory exception applies.

A service-provider or contractor contract must identify specific business purposes, prohibit sale or sharing, restrict retention, use, and disclosure outside those purposes and the direct business relationship, restrict combining data except as allowed, require compliance with the CCPA, allow monitoring, require notice if the recipient can no longer comply, and let the business stop and remediate unauthorized use. It must also require assistance with consumer requests and, where applicable, cybersecurity audits and risk assessments.

A third-party contract for sold or shared information must identify limited and specified purposes, require the third party to comply with the CCPA and provide the same level of privacy protection, allow reasonable steps to verify compliant use, require notice if the third party can no longer comply, and give the business the right to stop and remediate unauthorized use. A third party without a section 7053-compliant contract may not collect, use, process, retain, sell, or share the personal information the business made available.

Execute the correct contract before making personal information available. If a service provider or contractor uses a subcontractor for the business purpose, the subcontract must bind that recipient to the same CCPA requirements. Due diligence and enforcement matter after signature: the regulations say that never enforcing the contract or exercising audit and test rights can affect whether the business may claim it lacked reason to believe the recipient intended a violating use.

Keep the executed agreement and effective date, role analysis, data-flow record, data categories, specific purposes, sale or sharing analysis, subcontractor notices and terms, consumer-right assistance procedure, compliance notices, monitoring or audit evidence, remediation records, and approval trail. Link each contract obligation to the system and team that can carry it out.

For monitoring, retain the review scope, evidence requested, finding, recipient response, remediation owner, due date, retest, and closure decision. When the recipient says it can no longer comply, record when notice arrived, which data and systems are affected, whether transfers stopped, what data was returned or deleted, and how remediation was verified.

Common failures include relying on the word "processor" without meeting California's role tests, describing purposes generically, omitting the right to stop and remediate unauthorized use, allowing combination of data beyond the regulatory conditions, failing to flow terms to subcontractors, or leaving consumer-request assistance and compliance monitoring undefined.