What do teams get wrong about vendor due diligence under CPRA?

Why CPRA Vendor Due Diligence Is Really an Ongoing Control

Under CPRA, the mistake is treating vendor review as a one-time questionnaire instead of an operating discipline. A “reasonable steps” expectation only has value if the business can show that service providers, contractors, and third parties are still meeting the contract and the control intent after onboarding. Due diligence has to connect legal language, security testing, and follow-up action.

That means the question is not whether a vendor signed the right paper, but whether the business can verify that the vendor’s practices still match the promises made about handling personal information. Contract terms matter, but they do not prove implementation. The practical test is whether the oversight process can detect drift, escalation, and control failure before a violation becomes the company’s problem.

In practice, this is where vendor management often becomes too static. Teams close the file after procurement, yet CPRA risk persists across the full relationship lifecycle, especially when the vendor has broad access, subprocessor chains, or direct integration into customer-facing workflows. A due diligence program that never revisits access, retention, deletion, or security obligations is not really oversight, it is documentation.

What Reasonable Steps Should Cover in Vendor Oversight

Reasonable steps should be understood as a set of recurring checks that match the sensitivity of the data and the role of the vendor. For a low-risk supplier, a lighter review may be enough. For a processor handling large volumes of personal information, the business should expect stronger contract terms, control validation, and periodic reassessment. The required depth should rise with exposure.

The main error is assuming that every vendor needs the same process or that a signed data processing addendum resolves everything. The better approach is to align oversight with actual data access and operational dependence. A vendor that can store, transmit, or transform personal information should be assessed for technical safeguards, incident handling, retention discipline, and whether its own subcontractors are controlled in the same way.

Teams also underperform when they do not verify the controls they rely on. If a vendor claims encryption, deletion, or restricted access, the business should have some way to confirm that those controls exist and remain effective. For contract-heavy programs, the SOC 2 Trust Services Criteria is often used as one evidence source, but the report should supplement, not replace, direct oversight of the specific processing relationship.

Where Vendor Programs Break Down After the Contract Is Signed

The most common failure is assuming that legal allocation of responsibility is the same as control. Under CPRA, a business can still be exposed if it cannot show meaningful follow-through on vendor obligations. That failure usually appears in three places: weak onboarding review, no periodic revalidation, and no escalation path when the vendor’s posture changes.

Another common gap is overreliance on generic compliance claims. A vendor may describe itself as “CPRA ready,” but that statement does not answer whether it limits use, supports deletion, blocks unauthorized reuse, or keeps contractor access bounded. The business needs evidence that maps to the actual processing activity, not a marketing statement or a generic security attestation.

Vendor oversight also fails when teams do not look at the ecosystem around the vendor. If the provider uses subcontractors, shared infrastructure, or outsourced support, the practical control surface expands. The business’s duty is not to audit every downstream party equally, but it does need a defensible method for understanding where personal information is flowing and where the contractual safeguards stop.

Risk and Threat Considerations

Weak vendor due diligence turns legal compliance into a false assumption of protection. If the business cannot verify how a provider actually handles personal information, it may keep sharing data under terms that no longer match reality, which raises exposure during incidents, audits, and enforcement reviews.

Failure mechanism: The business relies on contract language without checking whether the vendor’s technical and operational controls still enforce the promised limits on collection, use, retention, deletion, and onward disclosure.

Impact: Personal information can be mishandled without timely detection, contractual protections may be weakened in practice, and the business may lose the ability to credibly argue that it took reasonable steps under CPRA.

Practitioner Guidance

What to verify: Tie each high-risk vendor to a documented control check that goes beyond signature collection. At minimum, verify data categories handled, access scope, deletion obligations, incident notification timing, and whether subcontractor use is disclosed and controlled.

Decision rule: If a vendor can materially affect how personal information is stored, used, or disclosed, treat it as an active control relationship and schedule recurring reassessment. If the vendor only supports a narrow administrative function with no meaningful data exposure, a lighter review may be justified.

Common mistake: Teams often accept contractual clauses as proof of compliance and then never test whether the clauses are being operationalized. The better standard is evidence-backed oversight, not paper-only assurance.

Practitioner takeaway: CPRA vendor diligence works when the business can demonstrate continuing control over real data handling behavior, not just initial legal onboarding.

Related resources from NHI Mgmt Group

• What do teams get wrong about grievance mechanisms under supply chain due diligence laws?
• What do teams get wrong about vendor onboarding and due diligence?
• What do security teams get wrong about acquisition due diligence?
• What do compliance teams get wrong about jurisdiction-specific KYC and due diligence requirements?