Law / United States / 
California
CCPA Regulations: contracts with service providers, contractors and third parties (article 4)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7050 to 7053
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Governance
As of .
What it requires
- Use a written contract with each service provider and contractor that prohibits it from selling or sharing the personal information, identifies the specific business purposes (not described in generic terms), bars retaining, using or disclosing the information for any other purpose or outside the direct business relationship, and requires it to comply with the CCPA and the Regulations at the same level of privacy protection (section 7051(a)(1) to (5)).
- In that contract, reserve your right to take reasonable and appropriate steps to ensure consistent use and to stop and remediate unauthorized use, and require the service provider or contractor to tell you when it can no longer meet its obligations and to enable you to honor consumer requests (section 7051(a)(6) to (9)).
- If you are a service provider or contractor that subcontracts, have a contract with the subcontractor that complies with section 7051(a) (section 7051(b)).
- If you sell or share personal information with a third party, enter into an agreement that identifies the limited and specified purposes, limits the third party's use to them, requires the third party to comply with the CCPA and the Regulations at the same level of protection, and gives you the right to take reasonable steps to verify and to stop and remediate unauthorized use (section 7053(a)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Article 4 of the CCPA Regulations governs service providers, contractors and third parties, beginning with section 7050 on service providers and contractors. Section 7051 of the CCPA Regulations requires the contract with a service provider or contractor to prohibit it from selling or sharing the personal information it collects under the contract.
Section 7051(a)(7) of the CCPA Regulations requires the contract to oblige the service provider or contractor to notify the business after it determines that it can no longer meet its obligations under the CCPA and the Regulations. Under section 7051(b) of the CCPA Regulations, a service provider or contractor that subcontracts must have a contract with the subcontractor that complies with the CCPA and the Regulations.
Section 7053 of the CCPA Regulations requires a business that sells or shares a consumer's personal information with a third party to enter into an agreement with the third party. Under section 7053(a)(2) of the CCPA Regulations, the third-party agreement must specify that the personal information is made available only for limited and specified purposes and require the third party to use it only for those purposes. The Agency's regulations became effective on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.