Compare state privacy laws: processors
What processors must do and what the contract with them must say.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.
| State | Processor contract required |
|---|---|
| California | YesCal. Civ. Code § 1798.100(d) |
| Virginia | Yes§ 59.1-579(B) |
| Colorado | YesC.R.S. § 6-1-1305(5) |
| Connecticut | YesConn. Gen. Stat. § 42-521(b) |
| Utah | Yes§ 13-61-301(2) |
| Oregon | YesORS 646A.581(2) |
| Texas | Yes§ 541.104(b) |
| Montana | Yes§ 30-14-2813(2) |
| Delaware | Yes§ 12D-107(b) |
| Iowa | Yes§ 715D.5(2) |
| Nebraska | Yes§ 87-1115(2) |
| New Hampshire | YesRSA 507-H:7, II |
| New Jersey | YesC.56:8-166.16(e) |
| Tennessee | YesTenn. Code Ann. § 47-18-3306(b) |
| Minnesota | Yes§ 325M.13(c) and (e) |
| Maryland | Yes§ 14-4708(a) |
| Indiana | YesIC 24-15-5-2(a) |
| Kentucky | YesKRS 367.3619(2) |
| Rhode Island | Yes§ 6-48.1-7(c) |
| Louisiana | YesLa. R.S. 51:1780.4(D)(2) |
| Oklahoma | YesSB 546 § 9(B) (75A O.S. § 308) |
| Alabama | YesAct 2026-552, § 8(b) (Ala. Code § 8-44-8) |
| Vermont | YesAct 145, Sec. 1, 9 V.S.A. § 2415f(b) |
| Narrower laws | |
| Florida | YesFla. Stat. § 501.712(2) |
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)