---
title: "Draft a service-provider contract or a business-associate agreement from the processing facts"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-processing-agreement-from-the-processing-facts/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-A20260923-3-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Draft a service-provider contract or a business-associate agreement from the processing facts

> From the processing memo, list the parties, the data categories, the stated purpose, and whether the data are personal information, protected health information, or both. Produce clause headings only.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-processing-agreement-from-the-processing-facts/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the processing memo, list the parties, the data categories, the stated purpose, and whether the data are personal information, protected health information, or both. Produce clause headings only. |
| What the lawyer must review | Civil Code section 1798.100(d) requires an agreement when a business sells or shares personal information with a third party or discloses it to a service provider or contractor for a business purpose. The agreement must limit the purposes, require the same level of privacy protection, give the business step-in and remediation rights, and require notice if the recipient can no longer comply. Section 1798.140(ag) defines a service provider as a person that processes personal information for a business purpose under a written contract that prohibits selling or sharing, use outside the stated purposes, disclosure outside the relationship, and combining that information with other personal information except as the section allows. If the data are protected health information, HHS states that covered entities and business associates must enter a business-associate contract that sets permitted uses, forbids other uses, requires safeguards, and requires breach reporting. The HHS sample is not mandatory and is not a complete state-law contract. Opinion 512 and Model Rule 1.6 apply to the draft. |
| Written for | United States |
| Applies to | [Draft a data-processing agreement from the processing facts](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-processing-agreement-from-the-processing-facts.md) |

## Checking plan

- What the AI does: From the processing memo, list the parties, the data categories, the stated purpose, and whether the data are personal information, protected health information, or both. Produce clause headings only.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A GDPR-style data-processing agreement is not the US instrument. Pick the CCPA contract, the HIPAA business-associate contract, or both.
- HHS says the sample language alone may not make a binding contract under state law.

## Sources

- [California Civil Code section 1798.100 (general duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [HHS: Sample business associate agreement provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html) (checked 2026-10-22)
- [California Civil Code section 1798.140 (CCPA definitions, including service provider)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [CCPA service provider and contractor addendum](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-ccpa-service-provider-addendum.md) | Agreement | Yellow | Contract terms for a California service provider or contractor under Civil Code §§ 1798.100(d) and 1798.140. It limits purpose, bars sale and sharing, and sets notice and deletion help.… |
| [Service-provider safeguards addendum](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-vendor-safeguards-addendum.md) | Agreement | Yellow | A short contract addendum for a service provider that will hold customer information of a financial institution covered by the FTC Safeguards Rule. It follows 16 CFR § 314.4(f).… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*