Comprehensive State Consumer Data Protection Acts: Part 3 – Obligations With Regard To Processors/Service Providers And Enforcement

In this final part of our series on the comprehensive state consumer data privacy acts, we address what a business that is a controller needs to know if it engages a "processor" with whom it shares personal information or data. Then we discuss what are the enforcement mechanisms for each of the three Acts. Finally, we walk through the additional steps to take to make sure you are - and remain - in compliance with the Acts.

1. Controller/business obligations with regard to processors/service providers, contractors and third-parties

If you retain an IT provider (a) with which you share personal information or (b) that processes personal data for you, you will remain the controller/business of the personal data, but your IT provider will be the processor. In this instance, under each Act you MUST enter into a contract (or amend your existing contract) with the IT provider that does the following: