Service Provider and Contractor Requirements

The service provider and contractor requirements detail the duties of third-party vendors who process personal information on behalf of a business under the CCPA/CPRA. They must only use data as instructed, maintain reasonable security, limit retention to the contract's term, and may not sell or disclose the data except as expressly permitted.