Agreement · Technology, Media & Telecommunications / IT Contracts
CCPA service provider and contractor addendum
Contract terms for a California service provider or contractor under Civil Code §§ 1798.100(d) and 1798.140. It limits purpose, bars sale and sharing, and sets notice and deletion help. It is not a GDPR Article 28 agreement.
- Kind
- Agreement. A contract between two or more parties.
- Where it applies
- United States
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the 4 authorities it cites, for United States.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a business discloses personal information to a vendor for a business purpose and the vendor is to be a service provider or a contractor. Do not use it for a sale or a share, or where the vendor decides its own purposes. Confirm the customer meets the business test before relying on it.
Used for these tasks
- Draft a data-processing, IP, SLA or exit schedule from the playbook
- Map data locations and cross-border flows from the vendor DPA
- Draft a data-processing agreement from the processing facts
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may fill the purposes and the subcontractor list from the order. The lawyer decides whether the vendor is a service provider or a contractor, and whether the customer is a business, before anyone signs.
AI may
- Tick the business purposes the order actually describes, from the list in this addendum
- Insert the names of subprocessors the lawyer has already approved
- Compare a vendor draft with the prohibitions in § 1798.140 and list what is missing
AI must not
- Must not decide that the customer is a business, or apply an adjusted revenue figure
- Must not describe this addendum as a GDPR Article 28 agreement
- Must not allow a purpose that is cross-context behavioral advertising
The lawyer checks
- The role is service provider or contractor, matching how the information is actually used
- The purposes are limited and specified, and each one is a business purpose the statute lists or the lawyer has confirmed
- The customer, not the vendor, decides consumer requests, and the vendor's help matches §§ 1798.105 and 1798.130
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Technology, Media & Telecommunications / IT Contracts
- IT services statement of work template (under a master services agreement)
- Ransomware or cyber extortion payment report: fields on the ACSC form
- SaaS / cloud services agreement (Australian law, business customers)
- SaaS subscription and negative-option checklist
- Website and online platform terms of use (Australian business, with Australian Consumer Law carve-outs)
- AI standard clauses for AI features in cloud services (Bonterms AI Standard Clauses v1.0, CC0)
- Deed of assignment of intellectual property and moral rights consent (contractor or developer software)
- Service level schedule with service credits (SaaS, managed or hosted services)
- Register of Critical Infrastructure Assets: what the CISC page asks for
- Checklist for electronic consumer records
- SaaS subscription agreement
- AI addendum: ownership of AI-generated output, training-data rights and AI-specific warranties (customer-side)
- Email and SMS marketing campaign checklist (Spam Act consent, sender identification and unsubscribe)
- SOCI Act cyber incident report: 12-hour and 72-hour clocks
- Software source code escrow agreement (three-party: supplier, customer and escrow agent)
- AI vendor terms review checklist
- Statement of work
- Cross-border disclosure assessment for a technology vendor (APP 8 and s 16C checklist and record)
- Critical infrastructure risk management program: annual report contents
- Australian Government AI model clauses (DTA, BuyICT ClauseBank): use guide for agencies and suppliers
- Open source licence compliance review checklist (technology transactions and product releases)
- Security incident clause
- Consumer Data Right: data holder obligations on the CDR site
- Data protection, security and breach-notification schedule (processor terms)
- Software development agreement with AI coding-assistant and open-source terms
- Checklist: reviewing a vendor SaaS or technology contract (customer side, including AI terms)
All precedents for Technology, Media & Telecommunications / IT Contracts · Tasks and AI use in this area