Contractual Requirements For Vendor Contracts Under The CCPA

1. Background

It may be time to scrutinize your data maps and data processing agreements. With the recent modifications to the California Consumer Privacy Act that the California Privacy Rights Act (collectively, CCPA) ushered in, the protections afforded to personal information now flow downstream from businesses to service providers, contractors, and third parties.

Generally, disclosures made by a business to another entity trigger CCPA's opt-out rules (e.g., requiring placement of a "Do Not Sell or Share My Personal Information" link on your homepage), unless an exception applies. One such exception is the disclosure of personal information to service providers or contractors for a business purpose. Broadly speaking, a business purpose is the use of personal information in furtherance of the services for which the personal information was disclosed. However, such disclosures are subject to contractual terms, as specified by CCPA. Without such contractual