Contractor Requirements (1798.140(j))

The contractor requirements under 1798.140(j) obligate businesses to contract only with service providers who will use personal information solely for the purposes specified by the business, prohibit further disclosure except as required by law, and implement reasonable security measures. Contracts must be in writing, enforceable, and include provisions that the contractor will not retain the data longer than necessary.