US state privacy laws: processor contract requirements by state

If you run a services company, your clients are the controllers and you are the processor (California says "service provider"). Each state law with a processor section tells the controller what the contract between you must contain, so that list is what your clients' lawyers are checking when they send you "our DPA."

The table below puts those lists side by side. For why the lists look the way they do, and what California does differently, read the explainer on what US state privacy laws require in a processor contract. For California's terms in full, see the nine §7051 contract terms; the California row only summarizes them.

Each column is one term that most of these statutes require the contract to contain. A cell says what that state's text requires, in short form; the statute is the authority.

• Instructions and scope. Most states require the contract to set out the processing instructions, the nature and purpose of processing, the type of data, how long processing lasts, and both parties' rights and obligations. Colorado, Minnesota and New Jersey also bring their security-measures section into the contract. Maryland adds security practices and stopping processing on an authenticated consumer request. California instead requires the specific business purposes, described without generic references, and bars use outside them.
• Confidentiality. Every state except California requires that each person processing the data is under a duty of confidentiality. California's contract terms require the service provider to give the data the same level of privacy protection the CCPA requires.
• Delete or return. At the end of the services, the processor deletes or returns the data as the controller directs, unless a law requires it to keep the data. California's statutory and regulatory contract lists don't include this term.
• Compliance info and audits. Every state except California requires the processor to provide information that shows compliance; California instead gives the business the right to take reasonable steps to check how the data is used. Most add a right to assessments, with an independent assessor as the alternative. Colorado, Minnesota and New Jersey describe the independent route as at least annual and at the processor's expense, and Colorado and New Jersey require the controller's consent to it. Iowa has no assessment term.
• Subcontractors. Every state requires a written contract that binds the subcontractor to the processor's obligations. Colorado, Delaware, Maryland, Minnesota, New Hampshire and Rhode Island add that the processor engages a subcontractor only after giving the controller an opportunity to object. California requires the service provider to notify the business. The sub-processor notice guide covers what that means in practice.
• Statute and As of. The citation for the row and the date it was last checked against the statute's text.

A state gets a row only after its statute has been read on the legislature's own site or the code publisher it names as official. Connecticut, Indiana, Tennessee and Utah also have comprehensive privacy laws, but their official statute pages couldn't be opened when this table was built. They're on the pending note above and will be added once checked.

Oklahoma's law takes effect on 1 January 2027 and Alabama's is reported to take effect on 1 May 2027. Each gets a row once it's in force and its text is checked. Delaware's amendment that adds a specific-purposes term takes effect on 1 January 2027; the Delaware row will change then.

Most of the variation is in a few cells: purpose limits, objection rights before a new subcontractor, and how audits work. That's why many services companies keep one standard DPA and send it to every client rather than signing each client's version. Whether your text covers the states your clients are in, and how, is a question for your counsel.

Pacts sends your standard DPA as an accept link and keeps a record of who accepted which version. When you publish a new version, it asks earlier acceptors to accept the new text. More for media and performance-marketing shops.