--- title: "Compare state privacy laws: processors" canonical: "https://dposchool.com/state-privacy-laws/topic/processors" source: - "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." - "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/" - "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" - "https://www.cga.ct.gov/current/pub/chap_743jj.htm" - "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html" - "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" - "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm" - "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" - "https://delcode.delaware.gov/title6/c012d/index.html" - "https://www.legis.iowa.gov/docs/code/715D.pdf" - "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" - "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm" - "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" - "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" - "https://www.revisor.mn.gov/statutes/cite/325M.10" - "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" - "https://iga.in.gov/ic/2026/Title_24.pdf" - "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092" - "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" - "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202" - "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" - "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" - "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" - "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- # Compare state privacy laws: processors What processors must do and what the contract with them must say. Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice. | State | Processor contract required | | --- | --- | | [California](https://dposchool.com/state-privacy-laws/state/california/processors) | Yes (Cal. Civ. Code § 1798.100(d)) | | [Virginia](https://dposchool.com/state-privacy-laws/state/virginia/processors) | Yes (§ 59.1-579(B)) | | [Colorado](https://dposchool.com/state-privacy-laws/state/colorado/processors) | Yes (C.R.S. § 6-1-1305(5)) | | [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut/processors) | Yes (Conn. Gen. Stat. § 42-521(b)) | | [Utah](https://dposchool.com/state-privacy-laws/state/utah/processors) | Yes (§ 13-61-301(2)) | | [Oregon](https://dposchool.com/state-privacy-laws/state/oregon/processors) | Yes (ORS 646A.581(2)) | | [Texas](https://dposchool.com/state-privacy-laws/state/texas/processors) | Yes (§ 541.104(b)) | | [Montana](https://dposchool.com/state-privacy-laws/state/montana/processors) | Yes (§ 30-14-2813(2)) | | [Delaware](https://dposchool.com/state-privacy-laws/state/delaware/processors) | Yes (§ 12D-107(b)) | | [Iowa](https://dposchool.com/state-privacy-laws/state/iowa/processors) | Yes (§ 715D.5(2)) | | [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska/processors) | Yes (§ 87-1115(2)) | | [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire/processors) | Yes (RSA 507-H:7, II) | | [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey/processors) | Yes (C.56:8-166.16(e)) | | [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee/processors) | Yes (Tenn. Code Ann. § 47-18-3306(b)) | | [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota/processors) | Yes (§ 325M.13(c) and (e)) | | [Maryland](https://dposchool.com/state-privacy-laws/state/maryland/processors) | Yes (§ 14-4708(a)) | | [Indiana](https://dposchool.com/state-privacy-laws/state/indiana/processors) | Yes (IC 24-15-5-2(a)) | | [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky/processors) | Yes (KRS 367.3619(2)) | | [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island/processors) | Yes (§ 6-48.1-7(c)) | | [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana/processors) | Yes (La. R.S. 51:1780.4(D)(2)) | | [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma/processors) | Yes (SB 546 § 9(B) (75A O.S. § 308)) | | [Alabama](https://dposchool.com/state-privacy-laws/state/alabama/processors) | Yes (Act 2026-552, § 8(b) (Ala. Code § 8-44-8)) | | [Vermont](https://dposchool.com/state-privacy-laws/state/vermont/processors) | Yes (Act 145, Sec. 1, 9 V.S.A. § 2415f(b)) | | **Narrower laws** | | | [Florida](https://dposchool.com/state-privacy-laws/state/florida/processors) | Yes (Fla. Stat. § 501.712(2)) | ## Other comparisons - [Applicability](https://dposchool.com/state-privacy-laws/topic/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/topic/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/topic/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/topic/controller-duties) - [Enforcement](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Compare: Processors Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents