Extract to table

From a risk perspective, the introduction of a sub-processor does not reduce the universe of applicable regulatory obligations — it expands the attack surface and the number of entities with access to potentially sensitive personal information, thereby compounding the risk profile that VMS must manage

Under the CCPA/CPRA framework, Cloudvault — as an entity that processes personal information on behalf of Meridian, which in turn processes personal information on behalf of VMS — must be contractually designated and bound as either a "service provider" or a "contractor" (as those terms are defined under Cal

• VMS must be prepared to respond to consent requests promptly

The sub-processor's processing of VMS data must be limited to the specific purpose and scope described in the DPA and the sub-processor's listing in Annex C

The sub-processor agreement must include confidentiality obligations binding on all sub-processor personnel who may have access to VMS data, including employees, contractors, and agents

The sub-processor must implement technical and organizational security measures at least equivalent to those specified in Annex B to the VMS-Meridian DPA