Florida Digital Bill of Rights
Florida privacy law: processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Processors must follow the controller's instructions and help it meet its duties, including requests, security and breach notice, and assessments. A contract must set out processing instructions, nature and purpose, data types, duration, and both parties' rights and duties, and must bind the processor to confidentiality, deletion or return, information sharing, assessments and flow-down to subcontractors.
Key points
Processor must assist with consumer requests, security and breach notification, and data protection assessments.
Section: Fla. Stat. § 501.712(1)
Contract must state instructions, nature and purpose, type of data, duration, and rights and obligations.
Section: Fla. Stat. § 501.712(2)(a)-(e)
Contract must require confidentiality, deletion or return at the end, information to show compliance, cooperation with assessments, and written flow-down to subcontractors.
Section: Fla. Stat. § 501.712(2)(f)
Processor may instead use an independent assessor's report against an accepted framework.
Section: Fla. Stat. § 501.712(3)
Whether a party is a controller or processor is a fact-based question.
Section: Fla. Stat. § 501.712(5)
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Florida statute
Reference material, not legal advice.