CCPA service provider contracts: which terms are required?

Most firms hand client, employee and prospect data to dozens of outside companies: payroll, email marketing, CRM, cloud storage, e-signature, managed IT. Under the California Consumer Privacy Act (CCPA), each of those relationships must meet the CCPA service provider contract requirements: a written agreement with specific terms. If the terms are missing, the vendor is legally a third party, and handing it personal information can be treated as a sale or sharing that consumers have the right to opt out of.

Which vendors need a CCPA service provider contract?

Every vendor that receives personal information from your firm to perform a business purpose on your behalf needs one. Civil Code section 1798.100(d) requires an agreement whenever a covered business sells or shares personal information with a third party or discloses it to a service provider or contractor for a business purpose. The service provider and contractor definitions in section 1798.140 require that agreement to be a written contract.

The CCPA only reaches firms that meet its business definition, most commonly annual gross revenue above $26,625,000 as adjusted on January 1, 2025. For RIAs, broker-dealers and insurance agencies, client account data handled under the Gramm-Leach-Bliley Act is usually outside the CCPA, as covered in our article on the CCPA GLBA exemption. Employee, applicant, website visitor and marketing data generally is not. That means the vendors that touch HR files, payroll, recruiting, your website and your email lists are the ones to check first.

What are the CCPA service provider contract requirements?

A CCPA service provider contract must contain ten terms. Section 7051(a) of the CCPA regulations lists the terms every service provider and contractor contract must contain. The contract must:

• Prohibit the vendor from selling or sharing personal information it collects under the contract.
• Identify the specific business purposes for which the vendor processes the information, and state that you disclose it only for those purposes.
• Prohibit the vendor from retaining, using or disclosing the information for any purpose other than those business purposes, unless the CCPA or the regulations permit it.
• Prohibit retention, use or disclosure for any other commercial purpose.
• Prohibit retention, use or disclosure outside the direct business relationship, including combining it with personal information from other sources, unless expressly permitted.
• Require the vendor to comply with the CCPA, provide the same level of privacy protection the law requires of you, cooperate with consumer requests, and maintain reasonable security under Civil Code section 1798.81.5.
• Give you the right to take reasonable and appropriate steps to confirm the vendor uses the information consistently with your obligations, such as manual reviews, automated scans, and assessments, audits or testing at least once every 12 months.
• Require the vendor to notify you if it determines it can no longer meet its CCPA obligations.
• Give you the right, on notice, to stop and remediate unauthorized use, including requiring proof that data subject to a deletion request is no longer retained or used.
• Require the vendor to help you respond to consumer requests, or require you to tell the vendor which requests it must act on and give it the information to do so.

The statute's own list in section 1798.100(d) covers five of these points. The regulations add the rest, and the statutory definition of a service provider in section 1798.140(ag) repeats the bans on selling, sharing, secondary use and combining data.

Why can't the contract describe the business purpose in generic terms?

The contract cannot describe the business purpose in generic terms because section 7051(a)(2) of the regulations says the business purposes "shall not be described in generic terms." A clause that lets a vendor use data "to provide the services" or "for any lawful business purpose" does not meet that standard.

In practice, the purpose should describe what the vendor actually does with the data. A payroll provider processes employee compensation, tax withholding and benefits deductions. An email platform sends newsletters to subscribers who opted in. A managed IT provider administers user accounts, devices and backups. Many vendors publish a standard data processing addendum written for European law. Those addenda often cover security well and describe purposes broadly, so read the purpose clause against section 7051(a)(2) before you accept it.

How is a contractor different from a service provider?

A service provider processes personal information on your behalf. A contractor is a person to whom you make personal information available for a business purpose. Both need a written contract with the same core prohibitions, and the contractor definition in section 1798.140(j) adds two items: the contractor must certify that it understands the restrictions and will comply with them, and the contract may permit you to monitor compliance, for example through audits at least once every 12 months.

The practical difference is small for most firms. Adding a certification clause to your standard vendor addendum lets one template work for both.

What happens if a vendor's contract is missing the required terms?

A vendor whose contract is missing the required terms loses its status as a service provider. Regulation section 7050(e) says a person who does not have a contract that complies with section 7051(a) is not a service provider or a contractor under the CCPA, and that disclosing personal information to that person may be considered a sale or sharing. A sale or sharing brings notice and opt-out obligations your firm may not have set up for that data flow.

The California Privacy Protection Agency has enforced this. In its March 2025 order against American Honda Motor Co., the agency found that Honda could not produce contracts with the advertising technology companies receiving consumers' personal information. The order, part of a $632,500 fine that also addressed other violations, required Honda to modify its contract management and tracking process so that all required contractual terms are in place with all external recipients of personal information. Honda admitted some of the factual findings, neither admitted nor denied the rest, and did not admit liability.

Administrative fines under section 1798.155 run up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16, as adjusted January 1, 2025.

Does the contract protect your firm if the vendor misuses data?

The contract protects your firm only partly, and only if you use it. Under Civil Code section 1798.145(i), a business that discloses personal information to a service provider or contractor in compliance with the CCPA is not liable for the vendor's violations if, at the time of disclosure, it did not have actual knowledge, or reason to believe, that the vendor intended to commit them.

Regulation section 7051(c) narrows that defense. Whether you conduct due diligence on your vendors factors into whether you had reason to believe. A business that never enforces the contract terms and never exercises its rights to audit or test the vendor's systems might not be able to rely on the defense. The audit and remediation rights in the contract only help if someone at your firm exercises them. Our article on vendor oversight after the contract is signed covers what that monitoring looks like in practice.

Do subcontractors need the same terms?

Yes, subcontractors need the same terms. Regulation section 7051(b) requires a service provider or contractor that subcontracts its work to have a contract with the subcontractor that complies with the CCPA and the regulations, including the section 7051(a) terms. Section 1798.140(ag)(2) also requires a service provider to notify the business when it engages another person to help process personal information. Ask each vendor for its list of subprocessors and how it binds them. This matters most for cloud platforms and AI tools, which often rely on several layers of infrastructure providers; our guide to AI vendor data terms covers the questions to ask.

What should you do this quarter?

As of November 2026, start with the vendors that touch data outside any GLBA exemption and work through these steps:

• Confirm the CCPA applies to your firm and which data sets fall outside any GLBA exemption.
• Pull your vendor inventory. If you do not have one, start from accounts payable and the apps connected to Microsoft 365 or Google Workspace. CIS Control 15 is a practical framework for building it.
• Flag every vendor that receives employee, applicant, prospect, website or marketing personal information.
• For each one, find the signed agreement and any data processing addendum, and check it against the ten terms in section 7051(a). Pay attention to the purpose clause.
• Send a standard CCPA addendum to vendors whose contracts fall short, with a contractor certification clause included.
• Ask vendors for their subprocessor lists and confirm they flow the same terms down.
• Put the monitoring rights on a calendar: an annual review or assessment for each vendor that holds sensitive data, with the results kept on file.
• Take the decisions listed in the counsel review section below to counsel before you send the addendum.

What should your counsel review before you send the addendum?

Do this review before you send a standard CCPA addendum to vendors, and again whenever a vendor rejects or redlines it. Bring these decisions:

• Which of your data sets fall under the GLBA exemption in Civil Code section 1798.145 and which do not. Bring your data inventory and your privacy notices.
• Whether each vendor is a service provider, a contractor or a third party under Civil Code section 1798.140(ag) and (j) and regulation section 7050. Bring the vendor agreement and a plain description of what the vendor does with your data.
• Whether a vendor's data processing addendum, and its purpose clause in particular, meets regulation section 7051(a). Bring the signed agreement, the addendum and any vendor redlines.
• Whether past disclosures to vendors without compliant contracts were a sale or sharing under regulation section 7050(e) that needed notice and an opt-out. Bring the list of those vendors, your privacy policy and your current opt-out process.

How can s90 help?

If you cannot say which vendors hold your clients' and employees' personal information, or whether those contracts would stand up if a regulator asked for them, that is the place to start. s90 is itself a service provider to the firms we support. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production. Through our CCPA compliance service we can help build the vendor inventory, map which systems hold which personal information, and gather the security evidence your annual vendor assessments call for. If that would help, talk with our team.