Data Privacy Clauses: CCPA, State Laws, and What Your Contracts Need
With 20+ US states enacting privacy laws, your contracts need data privacy clauses even if you’re not subject to GDPR. Here’s what to include.
The US privacy landscape in 2026
There is no single federal privacy law in the US (unlike the EU’s GDPR). Instead, you have a patchwork of state laws. California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah, Texas, Oregon, Montana, and more than a dozen other states have enacted comprehensive privacy legislation.
If you have customers in multiple states, your contracts need to account for all applicable laws.
What your vendor contracts need
Every contract with a vendor that processes personal data should include: a clear definition of personal information processed, the purposes for which data may be used, a prohibition on selling or sharing data, data retention and deletion requirements, security standards, breach notification timelines, sub-processor controls, and audit rights.
This is essentially a DPA lite — not as detailed as a GDPR DPA, but covering the same core principles.
Key takeaway
Even without GDPR obligations, US state privacy laws require specific contractual provisions in every vendor agreement that involves personal data.
CCPA-specific requirements
Under CCPA/CPRA, businesses must include specific language in their vendor contracts: the vendor is a "service provider" (not a "third party"), the vendor shall not sell or share personal information, the vendor shall not use data for any purpose other than performing the services, the vendor shall comply with CCPA upon request, and the vendor shall notify you of any sub-processor arrangements.
Watch out: Under CCPA, if your vendor is not properly designated as a "service provider" in the contract, their receipt of personal data could be classified as a "sale" — requiring consumer opt-out rights.
Practical compliance steps
1. Inventory all vendors that process personal data. 2. Review contracts for required privacy language. 3. Add DPA or privacy addendum where missing. 4. Ensure breach notification timelines are specified. 5. Verify sub-processor lists are current. 6. Schedule annual contract reviews for privacy compliance.
ClauseGuard’s analysis engine flags missing data privacy clauses and generates compliant language automatically.
Check your contracts for privacy compliance
Free, no account required.