DROP, Service Providers, and Contractors
Your internal processing can be correct while downstream copies remain untouched. Vendor handling is usually the least-mapped part of a DROP workflow.
Build the vendor inventory first
- Every service provider or contractor that receives, stores, or derives consumer personal information.
- What identifiers each one holds, and whether they hold derived or hashed values.
- The contractual mechanism for instructing them, and the required timing.
- The confirmation you will receive, and where that confirmation is retained.
- Sub-processors, where your vendor passes data onward.
Operational recommendation
Define the vendor instruction and confirmation path before your first cycle. Improvising it inside a 45-day window is where cadence slips.
Question to verify
Contract language, the scope of instructions you must issue, and the treatment of specific vendor relationships are legal questions for counsel.
This page describes CA DROP Broker's operational reading of publicly available California materials. Verify current requirements against official CalPrivacy sources and with qualified counsel.