Under the CCPA, what must a business's written contract with a service provider contain, and what follows if the contract falls short?

## Why the contract matters Under the CCPA as amended by the CPRA, a **service provider** is not a label a vendor chooses; it is a status the **contract** creates. Civil Code **1798.140(ag)(1)** defines it as a person that processes personal information on behalf of a business and receives it for a business purpose *pursuant to a written contract* that prohibits specified uses. Civil Code **1798.100(d)** separately requires a business that discloses personal information to a service provider or contractor for a business purpose to enter into an agreement with certain terms. The CPPA regulations at 11 CCR **7051** turn both into a checklist. ## The required terms 11 CCR 7051(a) requires the contract to: 1. **Prohibit selling or sharing** the personal information collected under the contract. 2. **Identify the specific business purposes** and state that the business discloses the data only for those limited and specified purposes. Generic wording, such as a reference to the whole contract, is not enough. 3. Prohibit retaining, using or disclosing the data **for any purpose other than** those business purposes, except as the CCPA and regulations permit. 4. Prohibit doing so for any **commercial purpose** other than those business purposes, unless expressly permitted. 5. Prohibit doing so **outside the direct business relationship**, including **combining** it with personal information from other sources or its own consumer interactions, unless expressly permitted. 6. Require compliance with the CCPA and the **same level of privacy protection** the law requires of businesses. 7. Grant the business the right to take **reasonable and appropriate steps** to ensure compliant use, such as manual reviews, automated scans, and assessments, audits or testing at least once every 12 months. 8. Require the vendor to **notify the business** if it determines it can no longer meet its obligations. 9. Grant the business the right, on notice, to **stop and remediate** unauthorised use. 10. Require the vendor to **enable the business to comply with consumer requests**, or require the business to pass requests on with the information needed. ## What the vendor may still do The prohibitions have regulated exceptions. Under 11 CCR **7050(a)** a service provider may also use the data to engage a compliant subcontractor, for **internal use to build or improve the quality of its services** to that business (so long as it does not use the data to perform services for another person), to detect and prevent security incidents and fraud, and for the purposes in Civil Code 1798.145(a)(1)-(7). The regulation's example: an email service may learn from engagement data to improve its service for everyone, but may not use one client's email list to send another client's marketing. ## Subcontractors A service provider that engages another person to help process the data must **notify the business** and bind that person by a written contract meeting the same requirements (1798.140(ag)(2); 7051(b)). The chain is only as good as its weakest contract. ## Due diligence after signing Signing is not the end of the duty. 11 CCR **7051(c)** says whether the business conducts **due diligence** factors into whether it had reason to believe the vendor was misusing data. A business that never enforces the contract or uses its audit rights **might not be able to rely** on the defence that it had no reason to believe the vendor would violate the law. | Contract state | Result under the CCPA | |---|---| | All 7051(a) terms present and enforced | vendor is a service provider; disclosure is for a business purpose | | Terms present, never checked | status stands, but the business's defence weakens (7051(c)) | | Required terms missing | vendor is **not** a service provider (7050(e)) | ## When the contract falls short 11 CCR **7050(e)**: a person without a contract that complies with 7051(a) **is not a service provider or a contractor**. The regulation's example spells out the consequence: disclosing personal information to that person **may be considered a sale or sharing**, which carries the consumer's right to opt out. How the opt-out then works is a separate subject; the point here is that a missing clause changes the legal character of an ordinary data flow. ## Engineering consequences - The data inventory should record, per recipient, whether a compliant contract exists and which business purposes it names. - Data sent to a vendor should match the named purposes; a support-ticket vendor has no need for full purchase history. - Deletion and correction must propagate, because the contract must let the business meet consumer requests (7051(a)(10); Civil Code 1798.130(a)(3)(A)). - A new use by the vendor, such as a new product line, is a contract change, not a configuration toggle.