CCPA RESOURCES CENTER › CCPA COMPLIANCE CHECKLIST
Vendor classification is really an extension of data mapping, but it’s such a large and complicated task that it deserves its own checklist. During this process, businesses must examine each of their vendors and determine whether they qualify as a CCPA service provider. Disclosures to service providers are exempted from the CCPA’s definition of selling personal information, so they are not covered by a consumer’s request to opt out. For this reason, it is a very important step.
The data privacy law’s contract requirement for service providers is usually the most relevant issue.
This information should already be in your business’s data map.
Service providers are not considered third parties, so no disclosure of personal information to a service provider is a sale.
Any sale or sharing of consumers’ personal information brings additional responsibilities under the CCPA.
This will help you make the proper disclosures to consumers and respond to requests to opt out.
This will make it much easier to respond to consumers’ privacy requests.
1. Review the written contract to see if it contains either:
or
If the answer is yes, classify the vendor as a service provider. If the answer no, then proceed below.
2. Contact the vendor and ask:
A DPA is an addendum to the vendor contract that meets the CCPA’s data privacy requirements.
If the answer is yes, classify the vendor as a service provider. If the answer is no, then classify the vendor as a third party and proceed below.
3. Determine if it is a sale or sharing of personal information:
If the answer to either of these questions is yes, the best course of action to treat the transaction as a sale of personal information. If the contract is completely silent about what the vendor can do with consumers’ personal information, it’s a gray area. The cautious approach would be to treat these disclosures as selling, even though they may not fall under the CCPA’s definition.
Classifying vendors can be slow, complicated, and frustrating. With TrueVault, our compliance experts have already spent hundreds of hours reading Terms of Services from the most commonly used vendors, and incorporated the key details into an easy-to-use automation tool. To save yourself days or even weeks of reviewing lengthy vendor agreements, contact our team today.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions.
201 Mission Street, 12th Floor
San Francisco, CA 94105
Email: hello@truevault.com
2024 © All Rights Reserved. Privacy Policy | Terms of Use | Supplemental Terms | California Privacy Notice