What is CCPA and CPRA?
The California Consumer Privacy Act of 2018 gives consumers more control over the personal information that businesses collect about them. The California Privacy Rights Act, passed as Proposition 24, amended it, and its amendments have been in effect since January 1, 2023. Consumers can know what is collected, delete, correct, opt out of sale or sharing and limit the use of sensitive personal information.
The California Privacy Protection Agency and the California Attorney General enforce the law. Consumers can sue only after certain data breaches. Administrative fines are set per violation, with a higher amount for intentional violations and for violations involving consumers the violator knows are under 16. The amounts are adjusted for inflation every two years, so check the California Privacy Protection Agency for the current figures.
The Agency's regulations, updated with an effective date of January 1, 2026, also cover risk assessments, cybersecurity audits and automated decisionmaking technology. Compliance dates differ: for automated decisionmaking technology used for significant decisions it starts January 1, 2027, and cybersecurity audit certifications are due between April 1, 2028 and April 1, 2030 depending on revenue.
A service provider is defined through its written contract. The regulations require terms that include naming specific business purposes, banning the sale or sharing of the information, banning use outside the direct business relationship, requiring compliance with the CCPA, giving the business a right to verify compliance, requiring notice if the provider can no longer comply and supporting consumer requests. A service provider that uses subcontractors must bind them with a contract that meets the same requirements. A vendor without a compliant contract may not qualify as a service provider, and disclosure to it could be treated as a sale or sharing.
How it touches on-site IT work
- Seeing personal information: names, contact details and account data can appear on screens, drives and tickets during a visit. A covered business should restrict use to the specific purpose in the contract.
- Service provider limits: the provider should not keep, use, combine or disclose the information outside the direct relationship. Copying data, keeping photos with personal information or reusing ticket content for other purposes would breach those limits.
- Deletion requests: a business must be able to act on consumer deletion requests. Copies on removed drives, photos and tickets held by a provider make that harder unless locations and retention are known.
- Subcontractors: independent engineers or partner firms that touch personal information need to be bound by terms that match the service provider contract.
- Security and incidents: consumers may sue after certain data breaches, so lost media, exposed records or misdirected photos matter. The contract should require prompt notice and notice if the provider can no longer meet its obligations.
- Verification: the business may take reasonable steps to confirm compliance, including assessments or testing, so records of work and handling should exist.
What you can agree in a written scope
- A service provider or contractor agreement with the terms the CCPA regulations require, in place before work starts.
- The specific business purpose of the work, described precisely and not in generic terms.
- No selling or sharing of personal information, and no use outside the direct business relationship.
- No combining the information with data from other sources, and no copies kept beyond the task.
- Rules for photos, tickets and logs: what is captured, where it is stored, who sees it and when it is deleted.
- Media handling: custody log, an agreed wipe or destruction method with evidence, and return or deletion at the end.
- Subcontractor terms: approval first, with a written contract that matches the same obligations.
- Incident and compliance notices: prompt notice of lost media or exposure, and notice if the provider can no longer meet its obligations.
- The business's right to verify compliance and to require remediation of unauthorized use.
- Support for consumer requests, such as finding and deleting records the provider holds.
Questions to ask any field services provider
- Will you sign a service provider agreement with CCPA terms before any work?
- What specific purposes will you use any personal information you see for?
- Where do you store photos, tickets and logs, and how long do you keep them?
- Which subcontractors or independent engineers will handle our information, and how are they bound?
- How will you help us respond to a deletion or access request?
- How do you track removed drives and media, and how quickly will you tell us about a loss?
- Will you accept our right to review how you comply?
This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.
Official sources
- California Attorney General: California Consumer Privacy Act (CCPA) (opens in a new tab)
- California Privacy Protection Agency: Laws and regulations (opens in a new tab)
- California Privacy Protection Agency: Final regulations announcement (September 2025) (opens in a new tab)
- California Privacy Protection Agency: Monetary thresholds in the CCPA (opens in a new tab)
- Cal. Code Regs. tit. 11, section 7051: Contract requirements for service providers and contractors (opens in a new tab)