In order to be considered a service provider under the CCPA, a legal entity must process personal information “on behalf of a business”[1] and be prohibited by contract from:
- Retaining the personal information “for any purpose other than for the specific purpose of performing the services specified in the contract . . . or