A business that sells or shares data with a third party must have an agreement that names the limited and specified purposes, permits use only for those, requires compliance with the Act including honouring opt-out signals and requests passed on by the business, gives the business rights to check and to stop and remedy misuse, and requires notice if the third party can no longer comply. A third party without such a contract may not collect, use, keep, sell or share the data, and one with a contract must keep to its terms (7052).
CCPA/CPRA CCR 7053 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CCPA/CPRA your existing evidence covers. Hold GDPR and 17 of 89 CCPA/CPRA controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the GDPR pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.