Extract to table

Under CCPA/CPRA, businesses that disclose consumers' personal information to other entities must ensure that such disclosures are properly classified and contractually governed

The contractor must also certify that it understands the restrictions and will comply with them

While the terminology and specific requirements vary across jurisdictions, the common thread is that controllers must contractually bind their processors to limitations on data use and must ensure contractual protections for consumer personal information

This represents a significant and ongoing compliance gap that must be addressed as a priority within the Phase 1 timeline

The vendor must notify Cascade of any actual or reasonably suspected security incident or personal-data breach within seventy-two (72) hours of discovery, and must cooperate with Cascade's incident-response and notification activities

Calderwood & Harkness's position is that CCPA requires meaningful audit rights, and while reasonable limitations on frequency and notice are acceptable, the core right to audit compliance with the DPA's data-processing restrictions must be preserved