28 CFR 202.258: a vendor agreement is any arrangement in which a person provides goods or services for payment (28 CFR 202.258(a))
Data collection or labelling work bought from a holder is a vendor agreement. It is restricted only when the holder is a covered person who is given access to bulk US sensitive personal data.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The term vendor agreement means any agreement or arrangement, other than an employment agreement, in which any person provides goods or services to another person, including cloud-computing services, in exchange for payment or other consideration.”
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide