Draft a service-provider contract or a business-associate agreement from the processing facts
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the processing memo, list the parties, the data categories, the stated purpose, and whether the data are personal information, protected health information, or both. Produce clause headings only.
- What the lawyer must review
- Civil Code section 1798.100(d) requires an agreement when a business sells or shares personal information with a third party or discloses it to a service provider or contractor for a business purpose. The agreement must limit the purposes, require the same level of privacy protection, give the business step-in and remediation rights, and require notice if the recipient can no longer comply. Section 1798.140(ag) defines a service provider as a person that processes personal information for a business purpose under a written contract that prohibits selling or sharing, use outside the stated purposes, disclosure outside the relationship, and combining that information with other personal information except as the section allows. If the data are protected health information, HHS states that covered entities and business associates must enter a business-associate contract that sets permitted uses, forbids other uses, requires safeguards, and requires breach reporting. The HHS sample is not mandatory and is not a complete state-law contract. Opinion 512 and Model Rule 1.6 apply to the draft.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| CCPA service provider and contractor addendum | Agreement | AI use Yellow | Contract terms for a California service provider or contractor under Civil Code §§ 1798.100(d) and 1798.140. |
| Service-provider safeguards addendum | Agreement | AI use Yellow | A short contract addendum for a service provider that will hold customer information of a financial institution covered by the FTC Safeguards Rule. |
Signed-in accounts can read the full text of each one. All precedents.