Ccpa Addendum: What It Covers and a Template (2026)

What is a CCPA addendum, and when do you need one? A CCPA addendum (often called a CCPA/CPRA addendum, a California privacy addendum or a data protection addendum) is a contract add-on that binds a vendor to the privacy terms California law requires. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), sets out specific terms that must appear in a contract before you can treat a vendor as a service provider or contractor rather than a third party. You need one when your business discloses California consumers' personal information to a vendor that processes it for you: a payroll provider, an analytics tool, a cloud host, a marketing platform, a support outsourcer. The right contract terms are what keep that disclosure from being treated as a sale or a share, which would carry its own duties and consumer opt-out rights. This article is general guidance, not legal advice. Privacy law changes often and the CPPA regulations are updated from time to time, so confirm the current statute and regulations and have a qualified professional review your addendum. ## The roles the CCPA uses The CCPA uses different words from GDPR. Getting the role right drives which terms you need. - Business. The entity that decides why and how consumers' personal information is processed and meets the CCPA thresholds.

• Service provider. A vendor that processes personal information on the business's behalf under a written contract for a business purpose, and does not use it for its own purposes.
• Contractor. Similar to a service provider; the contract requirements are close but include a compliance certification.
• Third party. Anyone who is not the business, a service provider or a contractor. Disclosing to a third party for value can be a sale or a share. ## The terms California law requires Under Cal. Civ. Code Section 1798.100(d), a contract with a service provider, contractor or third party must include terms that: 1. state that personal information is disclosed only for the limited and specified business purposes, described specifically and not in generic terms;

2. require the recipient to comply with the applicable obligations of the CCPA and to provide the same level of privacy protection the law requires of the business;
3. give the business the right to take reasonable and appropriate steps to confirm the recipient uses the personal information consistently with the business's obligations;
4. require the recipient to notify the business if it can no longer meet its CCPA obligations; and
5. give the business the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. For a service provider or contractor, the contract must also prohibit selling or sharing the personal information, prohibit retaining, using or disclosing it outside the direct business relationship or for a purpose other than the specified services, and prohibit combining it with data from other sources except as permitted. The CPPA regulations add detail, including that a service provider may engage a subcontractor only on terms that meet the same requirements. Confirm the current text of the regulations before relying on it. ## CCPA addendum template Copy the block below and attach it to your main agreement. ``` CALIFORNIA PRIVACY ADDENDUM (CCPA / CPRA) This Addendum forms part of the Agreement between [BUSINESS] ("Business") and [VENDOR] ("Service Provider") dated [DATE]. Terms used here have the meanings in the CCPA as amended by the CPRA. 1. ROLES The Business discloses Personal Information to the Service Provider for the Business Purposes described in Schedule A. The Service Provider acts as a service provider (or contractor) and not as a third party. 2. PERMITTED USE The Service Provider will process Personal Information only for the Business Purposes in Schedule A, described specifically, and for no other purpose. 3. RESTRICTIONS The Service Provider will not: (a) sell or share the Personal Information; (b) retain, use or disclose it outside the direct business relationship or for any purpose other than the Services; (c) combine it with personal information from other sources, except as the CCPA permits. 4. SAME PROTECTION The Service Provider will provide the same level of privacy protection the CCPA requires of the Business and will comply with its applicable CCPA obligations. 5. ASSISTANCE The Service Provider will help the Business respond to consumer requests (to know, delete, correct, opt out, and limit use of sensitive information) and to meet its security, risk-assessment and other duties. 6. MONITORING AND NOTICE The Business may take reasonable steps to confirm the Service Provider's use complies with this Addendum. The Service Provider will notify the Business if it can no longer meet its obligations, and the Business may take steps to stop and remediate unauthorised use. 7. SUBCONTRACTORS The Service Provider may engage subcontractors only under a written contract that imposes the same requirements, and stays responsible for them. 8. SECURITY The Service Provider will maintain reasonable security procedures and practices appropriate to the Personal Information. 9. DELETION On end of services, the Service Provider will delete or return the Personal Information unless retention is legally required. Signed for the Business: __________ Signed for the Service Provider: ____

- **Roles (clause 1).** Decide whether the vendor is a service provider, a contractor or a third party, and label consistently with how the data is really used.
- **Subcontractors (clause 7).** Require flow-down to subcontractors on the same terms, so the chain stays compliant.
- **Assistance (clause 5).** List the consumer rights the vendor must help you honour, so a request to delete or opt out does not stall at the vendor. ## Common mistakes to avoid - Describing the purpose in generic terms, which the statute does not accept.
- Leaving out the ban on selling, sharing and out-of-scope use, which can turn a transfer into a sale or share.
- No flow-down to subcontractors, which breaks the chain of compliance.
- Treating the CCPA addendum as identical to a GDPR DPA; the roles and required wording differ.
- Signing the terms but letting the vendor use the data for its own analytics, which undoes the protection. ## A note on scope and jurisdiction The CCPA addendum is specific to California. If you handle personal data from other regions you will need parallel terms: a GDPR data processing addendum under Article 28 for the EU and UK, and similar vendor terms under other laws such as Canada's PIPEDA, Australia's Privacy Act, and India's Digital Personal Data Protection Act, 2023. The duties rhyme (purpose limitation, security, subprocessing control, assistance with rights) but the defined terms and exact wording differ, so do not assume one addendum covers every region. Many companies use one combined data protection addendum with separate country sections. Last verified October 2026. ## Where one contract workspace helps A CCPA addendum rarely stands alone: the same privacy terms have to stay consistent across dozens of vendor contracts, each signed version has to be checked for a missing restriction or a generic purpose, and service-provider versus third-party status has to be kept straight as the rules change. Drafting, reviewing, tracking and governing a CCPA addendum can live in one AI workspace tuned to how your company contracts, with the clauses linked so a weak term is flagged and review dates stay in view. [Adira](https://adiralaw.com) is one tool built around that single-workspace idea for privacy paperwork like a CCPA addendum. This template alone is enough to put a fair addendum in place.