# US state privacy laws: processor contract requirements by state

_Published 2026-10-04 · Updated 2026-10-04_

**What this table is**

- Fifteen state privacy statutes, one row each, showing what a controller-processor (or business-service provider) contract must contain. Every row was checked against the statute itself on 4 October 2026.
- Most states share one core: processing instructions and scope, a duty of confidentiality, delete or return at the end, information and assessments to show compliance, and a written contract with any subcontractor.
- The differences are in the details: California's purpose-and-use limits, an opportunity to object before a new subcontractor in six states, and assessment terms that range from none (Iowa) to annual independent audits.
- Connecticut, Indiana, Tennessee and Utah also have comprehensive privacy laws; their rows are pending verification. Oklahoma and Alabama take effect in 2027. See the pending note under the table.
- This describes what the statutes say. It is not legal advice about your contracts.

If you run a services company, your clients are the controllers and you are the processor (California says "service provider"). Each state law with a processor section tells the controller what the contract between you must contain, so that list is what your clients' lawyers are checking when they send you "our DPA."

The table below puts those lists side by side. For why the lists look the way they do, and what California does differently, read the explainer on [what US state privacy laws require in a processor contract](/blog/state-privacy-law-processor-contract-requirements). For California's terms in full, see [the nine §7051 contract terms](/when/ccpa-service-provider); the California row only summarizes them.

## Processor contract requirements, state by state

**What each statute says the controller-processor contract must contain. Statute links are in the sources at the end of the page.**

| State | Instructions and scope | Confidentiality | Delete or return | Compliance info and audits | Subcontractors | Statute | As of |
| --- | --- | --- | --- | --- | --- | --- | --- |
| California | Specific business purposes, not described generically; bars selling or sharing and any use outside those purposes | No separate term; must provide the same level of privacy protection the CCPA requires | Not among the listed contract terms | Business may take reasonable steps to check compliance (e.g. assessments or audits at least every 12 months) and to stop unauthorized use; processor must say if it can no longer comply | Notify the business; written contract binding the subcontractor to the same terms | Cal. Civ. Code § 1798.100(d); § 1798.140(ag); 11 CCR § 7051 | 2026-10-04 |
| Colorado | Instructions, nature and purpose, data type, duration; security measures and who is responsible for them | Required | Required, at the controller's choice | Information to show compliance; allow audits and inspections, or (with the controller's consent) an independent audit at least annually at the processor's expense | Only after giving the controller an opportunity to object; written contract binding the subcontractor | C.R.S. § 6-1-1305(3)-(5) | 2026-10-04 |
| Delaware | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Only after giving the controller an opportunity to object; written contract binding the subcontractor | 6 Del. C. § 12D-107(b) | 2026-10-04 |
| Iowa | Instructions, nature and purpose, data type, duration, rights and duties of both parties | Required | Required, at the controller's direction | Information to show compliance on request; no assessment term | Written contract binding the subcontractor or agent to the processor's duties | Iowa Code § 715D.5(2) | 2026-10-04 |
| Kentucky | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Written contract binding the subcontractor to the processor's obligations | KRS 367.3619(2) | 2026-10-04 |
| Maryland | Instructions, nature and purpose, data type, duration, rights and obligations of both parties; security practices; stop processing on an authenticated consumer request | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments by the controller, its assessor or an independent assessor | Only after giving the controller an opportunity to object; written contract binding the subcontractor | Md. Code, Com. Law § 14-4708(a) | 2026-10-04 |
| Minnesota | Instructions, nature and purpose, data type, duration, rights and obligations of both parties; security measures and who is responsible for them | Required | Required, at the controller's choice | Information to show compliance; allow assessments and inspections, or an independent assessment at least annually at the processor's expense | Only after giving the controller an opportunity to object; written contract binding the subcontractor | Minn. Stat. § 325M.13(c)-(e) | 2026-10-04 |
| Montana | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Written contract binding the subcontractor to the processor's obligations | Mont. Code Ann. § 30-14-2813(2) | 2026-10-04 |
| Nebraska | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Written contract binding the subcontractor to the processor's obligations | Neb. Rev. Stat. § 87-1115(2)-(3) | 2026-10-04 |
| New Hampshire | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Only after giving the controller an opportunity to object; written contract binding the subcontractor | N.H. Rev. Stat. § 507-H:7(II) | 2026-10-04 |
| New Jersey | Instructions, nature and purpose, data type, duration; security measures and who is responsible for them | Required | Required, at the controller's discretion | Information to show compliance; allow assessments and inspections, or (with the controller's consent) an independent assessment at least annually at the processor's expense | Written contract binding the subcontractor to the processor's obligations | N.J.S.A. 56:8-166.16(c)-(e) | 2026-10-04 |
| Oregon | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to verify compliance on request; allow assessments by the controller, its designee or an independent person | Written contract binding the subcontractor to the processor's obligations | Or. Rev. Stat. § 646A.581(2) | 2026-10-04 |
| Rhode Island | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Only after giving the controller an opportunity to object; written contract binding the subcontractor | R.I. Gen. Laws § 6-48.1-7(c) | 2026-10-04 |
| Texas | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Written contract binding the subcontractor to the processor's obligations | Tex. Bus. & Com. Code § 541.104(b)-(c) | 2026-10-04 |
| Virginia | Instructions, nature and purpose, data type, duration, rights and obligations of both parties | Required | Required, at the controller's direction | Information to show compliance on request; allow assessments, or an independent assessment | Written contract binding the subcontractor to the processor's obligations | Va. Code § 59.1-579(B) | 2026-10-04 |

> **Pending** Connecticut, Indiana, Tennessee, Utah: rows not yet verified against the statute (the official sites could not be opened on 4 Oct 2026).
Delaware: 85 Del. Laws c. 463, in effect 1 Jan 2027, adds a contract term naming each limited and specific purpose of processing (https://delcode.delaware.gov/title6/c012d/index.html).
Oklahoma: SB 546, signed 20 Mar 2026, in effect 1 Jan 2027 (https://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600).
Alabama: HB 351, reported signed 16 Apr 2026 with an effective date of 1 May 2027; not yet confirmed on the legislature's site.

## How to read the columns

Each column is one term that most of these statutes require the contract to contain. A cell says what that state's text requires, in short form; the statute is the authority.

- **Instructions and scope.** Most states require the contract to set out the processing instructions, the nature and purpose of processing, the type of data, how long processing lasts, and both parties' rights and obligations. Colorado, Minnesota and New Jersey also bring their security-measures section into the contract. Maryland adds security practices and stopping processing on an authenticated consumer request. California instead requires the specific business purposes, described without generic references, and bars use outside them.
- **Confidentiality.** Every state except California requires that each person processing the data is under a duty of confidentiality. California's contract terms require the service provider to give the data the same level of privacy protection the CCPA requires.
- **Delete or return.** At the end of the services, the processor deletes or returns the data as the controller directs, unless a law requires it to keep the data. California's statutory and regulatory contract lists don't include this term.
- **Compliance info and audits.** Every state except California requires the processor to provide information that shows compliance; California instead gives the business the right to take reasonable steps to check how the data is used. Most add a right to assessments, with an independent assessor as the alternative. Colorado, Minnesota and New Jersey describe the independent route as at least annual and at the processor's expense, and Colorado and New Jersey require the controller's consent to it. Iowa has no assessment term.
- **Subcontractors.** Every state requires a written contract that binds the subcontractor to the processor's obligations. Colorado, Delaware, Maryland, Minnesota, New Hampshire and Rhode Island add that the processor engages a subcontractor only after giving the controller an opportunity to object. California requires the service provider to notify the business. The [sub-processor notice guide](/blog/subprocessor-change-notice-us-privacy-laws) covers what that means in practice.
- **Statute and As of.** The citation for the row and the date it was last checked against the statute's text.

[Download the table as a PDF](https://pacts.io/media/d6d7935cf2a32b20/sheet.pdf)

## Which states are missing, and why

A state gets a row only after its statute has been read on the legislature's own site or the code publisher it names as official. Connecticut, Indiana, Tennessee and Utah also have comprehensive privacy laws, but their official statute pages couldn't be opened when this table was built. They're on the pending note above and will be added once checked.

Oklahoma's law takes effect on 1 January 2027 and Alabama's is reported to take effect on 1 May 2027. Each gets a row once it's in force and its text is checked. Delaware's amendment that adds a specific-purposes term takes effect on 1 January 2027; the Delaware row will change then.

## Using the table when a client sends their DPA

Most of the variation is in a few cells: purpose limits, objection rights before a new subcontractor, and how audits work. That's why many services companies keep one standard DPA and send it to every client rather than signing each client's version. Whether your text covers the states your clients are in, and how, is a question for your counsel.

Pacts sends your standard DPA as an accept link and keeps a record of who accepted which version. When you publish a new version, it asks earlier acceptors to accept the new text. More for [media and performance-marketing shops](/for/media-services).

### Which US states require a written contract between a controller and a processor?

All fifteen states in the table do. Each statute says the contract must govern the processor's processing for the controller and lists what it must contain.

### Does every state let the controller object to a new subcontractor?

No. In the table, Colorado, Delaware, Maryland, Minnesota, New Hampshire and Rhode Island say a processor engages a subcontractor only after giving the controller an opportunity to object. California requires notice to the business. The rest require a written contract with the subcontractor but no notice or objection step.

### Is a California service provider contract the same as a processor contract elsewhere?

It overlaps but isn't the same. California's list centers on specific business purposes and limits on selling, sharing and other use, set out in Civil Code §1798.140(ag) and 11 CCR §7051. It doesn't list the confidentiality and delete-or-return terms most other states use. The nine §7051 terms are on the Pacts page about CCPA service provider terms.

### How often is this table checked?

Every month, against each statute's text. Each row shows the date it was last checked. Subscribers get one email when a change affects what these contracts must say.

### Can I rely on this table instead of legal advice?

No. It summarizes statutory text so you can see the requirements side by side. Whether a law applies to you, and what your contracts should say, are questions for your counsel.

**Sources**

- [Cal. Civ. Code § 1798.100(d)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100)
- [Cal. Civ. Code § 1798.140(ag)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140)
- [11 CCR § 7051](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)
- [C.R.S. § 6-1-1305(3)-(5)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [6 Del. C. § 12D-107(b)](https://delcode.delaware.gov/title6/c012d/index.html)
- [Iowa Code § 715D.5(2)](https://www.legis.iowa.gov/docs/code/715D.5.pdf)
- [KRS 367.3619(2)](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55840)
- [Md. Code, Com. Law § 14-4708(a)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4708&enactments=false)
- [Minn. Stat. § 325M.13(c)-(e)](https://www.revisor.mn.gov/statutes/cite/325M.13)
- [Mont. Code Ann. § 30-14-2813(2)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0130/0300-0140-0280-0130.html)
- [Neb. Rev. Stat. § 87-1115(2)-(3)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1115)
- [N.H. Rev. Stat. § 507-H:7(II)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)
- [N.J.S.A. 56:8-166.16(c)-(e)](https://pub.njleg.gov/bills/2022/PL23/266_.HTM)
- [Or. Rev. Stat. § 646A.581(2)](https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html)
- [R.I. Gen. Laws § 6-48.1-7(c)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm)
- [Tex. Bus. & Com. Code § 541.104(b)-(c)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)
- [Va. Code § 59.1-579(B)](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-579/)
- [85 Del. Laws c. 463 (Delaware amendment, effective Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)
- [Oklahoma SB 546 (2026), enrolled](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF)

_Pacts is not a law firm and this page is not legal advice. Speak to a licensed attorney about your situation._

Source: https://pacts.io/guides/state-privacy-law-contract-requirements-by-state