Relating to the regulation of certain business entities that act as data brokers.

Contracts

• Inbound Data Agreements: You must amend vendor contracts to include a "Source of Origin" warranty. You must be able to distinguish data you collected directly (exempt from the count) from data collected by a third party (counts toward the 50,000 threshold).
• Outbound Data Licenses: If you sell or transfer data, your Master Services Agreements (MSAs) must be updated to reflect your status as a registered Data Broker, as clients may require this certification for their own compliance.
• Service Provider DPAs: Clarify in Data Processing Agreements that vendors are processing on your behalf to avoid their actions being classified as a "sale" or "transfer" that contributes to revenue thresholds.

Hiring/Training

• Security Program Officer: You must designate an employee responsible for the comprehensive information security program (WISP) mandated by Chapter 509.
• Sales & Marketing Training: Teams must be trained to tag data sources in CRMs. They can no longer commingle "bought lists" with "organic leads" without tracking the provenance, as this affects your legal status.

Reporting & Record-Keeping

• Data Provenance Logs: Implement a tracking system to separate "Directly Collected" data from "Third-Party" data. You must be able to prove to an auditor that you fall *under* the 50,000 individual threshold if challenged.
• Secretary of State Registration: If the threshold is met, you must file the Data Broker registration form annually.
• Security Assessments: You must document periodic vulnerability testing and risk assessments as part of your WISP.

Fees & Costs

• Registration Fees: Budget for annual filing fees with the Secretary of State.
• Compliance Costs: Expect "Medium" cost impact related to legal counsel for applicability analysis and IT costs for segregating data flows and upgrading security protocols to NIST-aligned standards.