Third-Party Risk Management SOP - California
THIRD-PARTY RISK MANAGEMENT SOP — CALIFORNIA SUPPLEMENT
Organization: [________________________________]
SOP Number: TPRM-CA-[____]
Version: [____]
Effective Date: [__/__/____]
Approved By: [________________________________]
TABLE OF CONTENTS
- Purpose and Scope
- California Regulatory Framework
- Definitions
- Risk Tiering — California Enhancements
- Third-Party Lifecycle — California Requirements
- CPRA Service Provider/Contractor Framework
- Roles and Responsibilities
- Documentation and Systems of Record
- Metrics, KRIs, and Reporting
- Exceptions and Compensating Controls
- Review Cadence
- Annexes
1. PURPOSE AND SCOPE
1.1 Purpose
This SOP supplements the Universal TPRM SOP with California-specific requirements under the CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.) and CPPA implementing regulations (11 CCR § 7000 et seq.). The CPRA significantly enhanced obligations for businesses working with "service providers" and "contractors," including restrictions on use, retention, and disclosure; audit rights; subcontractor flow-down; and the recognition of Global Privacy Control (GPC) as a valid opt-out signal under § 1798.135 and 11 CCR § 7025.
1.2 Scope
Applies to all third-party relationships involving:
☐ Personal information of California consumers (Cal. Civ. Code § 1798.140(v))
☐ Sensitive personal information (§ 1798.140(ae))
☐ Services delivered to California operations or consumers
☐ Vendors classified as CPRA "service providers" (§ 1798.140(ag)) or "contractors" (§ 1798.140(j))
2. CALIFORNIA REGULATORY FRAMEWORK
| Statute/Regulation | Key Vendor Requirements |
|---|---|
| CPRA, § 1798.100(d) | Agreement terms: limited specified purposes; applicable-title compliance and same privacy protection; business reasonable-step rights; notice if obligations can no longer be met; business stop-and-remediate rights |
| § 1798.140(ag) | Service provider definition and contract requirements |
| § 1798.140(j) | Contractor definition and additional audit/certification requirements |
| § 1798.105 | Right to Delete — must flow through to service providers/contractors |
| § 1798.120-121 | Opt-out of sale/sharing; right to limit sensitive PI |
| § 1798.135, 11 CCR § 7025 | Recognition of GPC / universal opt-out preference signals |
| 11 CCR §§ 7200, 7220–7222 | ADMT regulations — effective January 1, 2026; covered-business compliance begins January 1, 2027 |
| § 1798.82 | Qualifying resident notice within 30 calendar days of discovery or notification, subject to statutory delays; redacted sample to AG within 15 calendar days after resident notice if notice is required for more than 500 California residents from one breach |
| § 1798.185(a)(14)(B), 11 CCR § 7150 | Risk assessments for processing that presents significant risk to privacy |
3. DEFINITIONS
| Term | Definition |
|---|---|
| Personal Information | Information that identifies, relates to, or is reasonably linkable to a California consumer or household (§ 1798.140(v)) |
| Sensitive Personal Information | SSN/government ID; account log-in or financial account numbers with required access credentials; precise geolocation; racial/ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership; mail/email/text contents when the business is not the intended recipient; genetic or neural data; biometric processing for unique identification; analyzed health, sex-life, or sexual-orientation data (§ 1798.140(ae)) |
| Service Provider | Entity that processes personal information on behalf of a business per a written contract meeting CPRA requirements (§ 1798.140(ag)) |
| Contractor | Entity to which a business makes available personal information for a business purpose per a written contract, with additional certification and audit requirements (§ 1798.140(j)) |
| Sale | Disclosing personal information for monetary or other valuable consideration (§ 1798.140(ad)) |
| Sharing | Cross-context behavioral advertising disclosure (§ 1798.140(ah)) |
4. RISK TIERING — CALIFORNIA ENHANCEMENTS
| Factor | Elevated Risk Indicators |
|---|---|
| CPRA Sensitive PI | Vendor processes sensitive personal information, including account credentials, citizenship or immigration status, neural data, or the other categories in § 1798.140(ae) |
| Sale or Sharing | Vendor relationship involves potential sale or sharing of personal information |
| Automated Decision-Making | Vendor uses ADMT for decisions with legal or similarly significant effects |
| Children's Data | Vendor processes data of consumers under 16 (opt-in consent required under § 1798.120(c)-(d)) |
| GPC/Opt-Out Signal Processing | Vendor must recognize and honor GPC signals |
| Cross-Context Behavioral Advertising | Vendor involved in targeted advertising using personal information from multiple businesses |
Vendors classified as CPRA service providers or contractors shall be classified no lower than Medium tier. Vendors processing sensitive PI shall be classified no lower than High tier.
5. THIRD-PARTY LIFECYCLE — CALIFORNIA REQUIREMENTS
5.1 Due Diligence Enhancements
| # | Requirement | Tier | Evidence |
|---|---|---|---|
| 5.1.1 | Determine vendor classification: service provider (§ 1798.140(ag)) vs. contractor (§ 1798.140(j)) vs. third party | All w/ CA PI | ☐ Classification analysis |
| 5.1.2 | Verify the agreement contains § 1798.100(d)'s five elements; separately map any use, retention, disclosure, sale, sharing, or combination restrictions to the current definition or regulation that supplies them | All SP/Contractor | ☐ DPA ☐ Policy review |
| 5.1.3 | Assess consumer rights support: Right to Know, Delete, Correct, Portability, Opt-Out of Sale/Sharing, Limit Sensitive PI | Critical/High | ☐ Rights workflow |
| 5.1.4 | Verify GPC/universal opt-out signal recognition (§ 1798.135, 11 CCR § 7025) | All w/ CA consumer-facing | ☐ Technical verification |
| 5.1.5 | Evaluate readiness for ADMT transparency, access, and opt-out capabilities required beginning January 1, 2027 (11 CCR §§ 7200, 7220–7222) | If ADMT used | ☐ ADMT documentation |
| 5.1.6 | Assess sensitive PI handling and ability to support "Limit Use" requests (§ 1798.121) | If sensitive PI | ☐ Sensitive data controls |
| 5.1.7 | Verify notice to the business and written subcontractor contracts binding each subprocessor to the applicable service-provider or contractor requirements | All SP/Contractor relationships using subprocessors | ☐ Subcontractor agreements |
| 5.1.8 | Assess breach notification capability | All w/ CA PI | ☐ IRP ☐ SLA |
5.2 Contract Requirements — California Additions
| Clause | Requirement | Citation |
|---|---|---|
| CPRA Service Provider/Contractor Agreement | Must include all § 1798.100(d) elements: limited specified purposes; applicable-title compliance and same protection; reasonable-step rights; inability-to-comply notice; stop-and-remediate rights | § 1798.100(d)(1)-(5) |
| Compliance and same protection | Agreement obligates applicable-title compliance and the same level of privacy protection | § 1798.100(d)(2) |
| Use/Retention/Disclosure Restrictions | No retention, use, or disclosure of personal information outside the contracted business purpose, except as permitted by the CCPA | § 1798.140(ag)(1)(B) |
| No Sale/Sharing | Vendor shall not sell or share personal information | § 1798.140(ag)(1)(A) |
| No Unauthorized Combining | Vendor shall not combine PI received from multiple businesses except as permitted | § 1798.140(ag)(1)(D) |
| Subcontractor Flow-Down | Service providers and contractors must notify the business when they or a further subprocessor engage another person for the business purpose, and bind that person by written contract to the applicable paragraph (1) requirements | § 1798.140(ag)(2), (j)(2) |
| Compliance Assessment Mechanism | Preserve the business's reasonable-and-appropriate-step rights; identify separate authority and negotiated scope for any audit | § 1798.100(d)(3) |
| Consumer Rights Cooperation | Vendor must assist with Right to Know, Delete, Correct, Portability, Opt-Out | §§ 1798.100-121 |
| GPC Compliance | Vendor must treat GPC signal as valid opt-out of sale/sharing | § 1798.135, 11 CCR § 7025 |
| Sensitive PI Limitation | Vendor must support "Limit the Use of My Sensitive PI" requests | § 1798.121 |
| Breach Notification | Notify the data owner or licensee immediately after discovery when § 1798.82(b) applies; use a negotiated [____]-hour clock for other incidents; support applicable resident and AG notices | § 1798.82(b), (a), (f) |
| Data Minimization/Retention | Retention limited to what is reasonably necessary for the disclosed purpose | § 1798.100(a)(3) |
| Deletion Obligation | Delete PI upon request, including instructing subcontractors to delete | § 1798.105(c) |
5.3 Ongoing Monitoring — California Additions
| Activity | Frequency | Responsible |
|---|---|---|
| CPRA compliance verification | Annual | Compliance / Privacy |
| Consumer rights request support review | Semi-Annual (Critical/High) | Privacy |
| GPC/opt-out signal compliance testing | Annual | Security / Privacy |
| ADMT readiness/compliance review (January 1, 2027 compliance date) | Annual | Privacy |
| Sensitive PI handling verification | Annual | Privacy |
| Subcontractor flow-down verification | Annual | Compliance |
| Breach notification readiness | Annual | Security / Compliance |
| Risk assessment review (§ 1798.185(a)(14)(B), 11 CCR § 7155) | At least every three years and after a material processing change | Privacy |
5.4 Offboarding — California Additions
☐ Confirm deletion of all CA consumer personal information per § 1798.105(c)
☐ Instruct vendor to direct subcontractors to delete CA PI
☐ Obtain written deletion certification
☐ Verify no retained copies except as required by law
☐ Document compliance with CPRA through termination
6. CPRA SERVICE PROVIDER/CONTRACTOR FRAMEWORK
6.1 Classification Decision Tree
| Question | If Yes | If No |
|---|---|---|
| Does the vendor receive PI from or on behalf of the business, or does the business make PI available to it? | Continue | Assess other data flows and roles |
| Does the vendor process PI on the business's behalf under a qualifying written contract (§ 1798.140(ag))? | Service Provider route; confirm contract restrictions | Continue to Contractor/Third Party review |
| Does the business make PI available for a business purpose under a qualifying written contract (§ 1798.140(j))? | Contractor route; confirm certification and monitoring terms | Assess Third Party or other status |
| Does the Contractor contract include certification of restrictions and permit monitoring (§ 1798.140(j)(1)(B)-(C))? | Contractor contract terms present | Remedy the Contractor contract |
| Does the proposed monitoring plan fit the relationship and the contract? | Document the plan | Negotiate the contract before relying on monitoring rights |
6.2 Service Provider vs. Contractor Key Differences
| Requirement | Service Provider | Contractor |
|---|---|---|
| Written contract with CPRA terms | Required | Required |
| Certification of understanding | Not required | Required |
| Monitoring terms | Contract may permit monitoring, subject to agreement (§ 1798.140(ag)(1), text following (D)) | Contract must permit monitoring, subject to agreement, including regular assessments, audits or testing at least once every 12 months (§ 1798.140(j)(1)(C)) |
| Use/retention/disclosure restrictions | Same | Same |
| Regulatory treatment | Established category | CPRA-new category |
7. ROLES AND RESPONSIBILITIES
| Role | CA-Specific Responsibilities |
|---|---|
| Privacy | CPRA classification; consumer rights support; GPC compliance; ADMT; sensitive PI; risk assessments |
| Compliance | CPRA regulatory updates; AG notification coordination; subcontractor flow-down verification |
| Security | Breach notification readiness; GPC technical implementation; security measures verification |
| Legal | CPRA contract terms; service provider/contractor classification; audit rights |
| Business Owner | Ensure SLAs support CA breach notification; consumer rights request coordination |
8. DOCUMENTATION
Additional TPRM platform fields:
☐ CPRA classification (service provider / contractor / third party)
☐ Service provider/contractor agreement status
☐ GPC compliance status
☐ Sensitive PI processing flag
☐ ADMT use flag
☐ Consumer rights support verification
☐ Subcontractor flow-down status
☐ Risk assessment completion status
9. METRICS
| Metric | Target | Frequency |
|---|---|---|
| CPRA-compliant SP/contractor agreements | 100% of applicable | Quarterly |
| GPC compliance verification | 100% of consumer-facing vendors | Annual |
| Consumer rights support verified | 100% of Critical/High | Annual |
| Subcontractor flow-down verified | 100% of SP/Contractor relationships using subprocessors | Annual |
| Risk assessments completed | 100% of high-risk processing | Semi-Annual |
| Breach notification SLA compliance | 100% | Per incident |
10. EXCEPTIONS
☐ CPRA-related exceptions require approval by [CPO / General Counsel]
☐ Document compensating controls with statutory reference
☐ Maximum exception duration: [____] days
11. REVIEW CADENCE
| Field | Information |
|---|---|
| SOP Owner | [________________________________] |
| Review Frequency | Annual, or upon CPPA regulatory change |
| Next Review | [__/__/____] |
12. ANNEXES
Annex A: CPRA Service Provider/Contractor Contract Checklist
☐ Purpose limitation — no use beyond contracted business purposes, except as permitted by the CCPA (§ 1798.140(ag)(1)(B))
☐ No sale or sharing (§ 1798.140(ag)(1)(A))
☐ No unauthorized combining (§ 1798.140(ag)(1)(D))
☐ Certification of understanding (Contractor only)
☐ Reasonable-and-appropriate-step rights (§ 1798.100(d)(3)); separate audit authority/scope identified
☐ Notification if unable to meet obligations (§ 1798.100(d)(4))
☐ Subcontractor notice and written flow-down contracts checked under § 1798.140(ag)(2) or (j)(2), as applicable: [________________________________]
☐ Consumer rights cooperation (Know, Delete, Correct, Portability, Opt-Out, Limit Sensitive PI)
☐ GPC/universal opt-out signal recognition (§ 1798.135, 11 CCR § 7025)
☐ Data minimization and retention limitation (§ 1798.100(a)(3))
☐ Breach notification SLA
☐ Deletion certification on termination
SOURCES AND REFERENCES
- CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.
- Cal. Civ. Code § 1798.140(ag) (Service Provider), § 1798.140(j) (Contractor)
- Cal. Civ. Code § 1798.82 (Breach Notification)
- CPPA Final Regulations, 11 CCR § 7000 et seq.
- 11 CCR § 7025 (Opt-Out Preference Signals)
- Cal. Civ. Code § 1798.185(a)(14)(B); 11 CCR §§ 7150–7157 (Risk Assessments)
- 11 CCR §§ 7200, 7220–7222 (ADMT Regulations; compliance begins January 1, 2027)
- OCC Bulletin 2023-17 (risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; not law)
- DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.
About this template
- Last updated
- October 28, 2026
- Jurisdiction
- California
- Category
- Compliance & Regulatory
Legal authority
- CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.
- Cal. Civ. Code § 1798.140(ag) (Service Provider)
- Cal. Civ. Code § 1798.140(j) (Contractor)
- Cal. Civ. Code § 1798.100(d) (Service Provider/Contractor Obligations)
- 11 CCR § 7000 et seq. (CPPA Regulations)
- 11 CCR § 7025 (Opt-Out Preference Signals / GPC)
- Cal. Civ. Code § 1798.185(a)(14)(B) (Risk Assessments)
- 11 CCR §§ 7150–7157 (Risk Assessment Regulations)
- 11 CCR §§ 7200, 7220–7222 (ADMT Regulations)
- Cal. Civ. Code § 1798.82 (Breach Notification)
- OCC Bulletin 2023-17 (Risk-Based Supervisory Guidance for Banking Organizations; Not Law)
- DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
The statutes this template relies on are listed under Legal authority.
11 Cal. Code Regs. § 7000(a) (checked October 27, 2026): "This Chapter shall be known as the California Consumer Privacy Act Regulations."
Cal. Civ. Code § 1798.140(ag)(1) (checked October 27, 2026): "“Service provider” means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:"
Cal. Civ. Code § 1798.140(j)(1) (checked October 27, 2026): "“Contractor” means a person to whom the business makes available a consumer’s personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:"
Cal. Civ. Code § 1798.140(ag)(1), text following (D) (checked October 28, 2026): "The contract may, subject to agreement with the service provider, permit the business to monitor the service provider’s compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months."
Draft your Third-Party Risk Management SOP - California in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.