Question 1

What is a Data Processing Agreement (DPA)?

Accepted Answer

A Data Processing Agreement (DPA) is a legally binding contract between a data controller (your business) and a data processor (your vendor) that governs how personal data is handled. Under US state privacy laws like the CCPA, CPA, CTDPA, and VCDPA, businesses must have written agreements with vendors that process personal data on their behalf. These agreements must include specific clauses covering the purpose of processing, data security, subprocessor management, consumer rights assistance, and data return or deletion obligations.

Question 2

Which states require a DPA or processor contract?

Accepted Answer

All 20 US states with comprehensive privacy laws require some form of processor contract or DPA. California (CCPA/CPRA) requires "service provider" or "contractor" agreements with specific terms including annual certification. Colorado, Connecticut, Virginia, Texas, Maryland, and other states require processor contracts that define processing instructions, establish confidentiality, allow audits, and mandate data deletion at contract end. The specific required clauses vary by state, which is why our tool generates state-specific requirements.

Question 3

What should be included in a vendor privacy assessment questionnaire?

Accepted Answer

A comprehensive vendor privacy assessment should cover eight key categories: Data Handling (what data is processed and how), Security Measures (encryption, access controls, certifications), Subprocessor Management (downstream vendors), Data Subject Rights (ability to fulfill consumer requests), Retention and Deletion (policies and procedures), Breach Notification (incident response), Cross-Border Transfers (international data flows), and AI/Automated Processing (use of data for model training or automated decisions). State-specific questions should be added based on where you operate.

Question 4

What is the difference between a processor and a third-party sale under privacy laws?

Accepted Answer

A processor (or service provider) processes personal data on behalf of and under the instructions of your business. A third-party sale involves transferring personal data to another entity that uses it for its own purposes, often for monetary consideration. The distinction matters greatly for compliance: processor relationships require DPAs but are generally permitted, while third-party sales trigger additional consumer rights (like opt-out) and stricter requirements under laws like the CCPA. Some states like Maryland ban the sale of sensitive data entirely.

Question 5

How often should vendor privacy assessments be conducted?

Accepted Answer

Best practice is to conduct initial vendor assessments before engaging any new vendor that will process personal data, then reassess annually or when significant changes occur. California CCPA requires annual certification from service providers. Trigger events for reassessment include: new state privacy laws taking effect, changes in data shared with the vendor, vendor security incidents, changes in the vendor's subprocessors, and expansion into new states. High-risk vendors (those processing sensitive, children's, or biometric data) should be assessed more frequently.

Vendor Assessment & DPA Questionnaire Generator

Where Does Your Organization Operate?

Vendor Assessment & DPA Questionnaire Generator

Where Does Your Organization Operate?