What Should We Do About The Draft CPRA Regulations?: Contracts

In this third post of our ongoing series, we examine key takeaways for companies in light of the recently released draft CPRA regulations. Today's focus is on contractual requirements. (Visit here for information about collection and notice under the draft regulations, and here for information about choice.)

The contractual requirements in the draft regulations do not mirror the statute and add entirely new obligations. For example, the draft regulations prescribe a new, five-day time period in which a service provider, contractor, or third party must notify the business if they determine they can no longer comply with the CPRA's requirements. The draft regulations also require contracts with service providers to identify the specific business purposes and services for which personal information will be processed and prohibit generic descriptions of such purposes, such as referencing the entire contract generally.