Exhibit B: Data Processing Addendum
Pursuant to the {{name_of_agreement}} dated {{date_of_agreement}} (“Agreement”) between NortonLifeLock Inc.
and its affiliates (“NortonLifeLock”), and {{third_party}} (“Partner”) (each a “Party”; collectively the “Parties”), and in
furtherance of each Party’s obligations under the California Consumer Privacy Act of 2018 (California Civil Code §§1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”), andany other applicable data protection legislation in the United States, the Parties hereby adopt this Data Processing
Addendum (“Addendum”), which will remain in effect for so long as NortonLifeLock maintains Partner-Provided
Personal Information (as defined below) pursuant to the Agreement. This Addendum prevails over any conflicting
terms of the Agreement.
1.

Definitions. For the purposes of this Addendum-1.1.
The capitalized terms used in this Addendum and not otherwise defined in this Addendum shallhave the definitions set forth in the CCPA.
1.2.
“Services” means the services or products provided by NortonLifeLock pursuant to the Agreement.

2.

Roles and Scope.
2.1.
This Addendum applies only to the Collection, retention, use, processing, and disclosure of
Personal Information for NortonLifeLock to provide Services directly to Partner or to perform aBusiness Purpose pursuant to the Agreement (“Partner-Provided Personal Information”).
Additionally, Personal Information shall mean Personal Information that Partner provides toNortonLifeLock for enrollment purposes only. Once a member of Partner’s personnel has enrolledwith NortonLifeLock, any Personal Information provided by the Partner’s personnel is solely theresponsibility of NortonLifeLock and is not subject to this Addendum.
2.2.
The Parties acknowledge and agree that each: (i) is an independent Business; (ii) will individually
determine the purposes and means of its Collection; retention, use, processing, or disclosure ofPartner-Provided Personal Information; and (iii) will comply with the obligations applicable under
the CCPA, or any other applicable data protection legislation in the United States. In the event that
the Services involve Personal Information collected outside of the United States, the Parties willenter into an applicable data processing addendum for such regions.

3.

Restrictions on Processing.
3.1.
Except as otherwise permitted by applicable law, each Party is prohibited from: (i) Selling PartnerProvided Personal Information; (ii) retaining, using, or disclosing Partner-Provided Personal
Information for any purpose other than for the specific purpose of performing the Services specified
in the Agreement, including retaining, using, or disclosing Partner-Provided Personal Information
for a Commercial Purpose other than providing the Services specified in the Agreement; and (iii)
retaining, using, or disclosing Partner-Provided Personal Information outside of the direct businessrelationship between NortonLifeLock and Partner.

4.

Deidentified Information.
4.1.
In the event that either Party shares Deidentified Information with the other Party, the receiving
Party warrants that it: (i) has implemented technical safeguards that prohibit reidentification of theConsumer to whom the information may pertain; (ii) has implemented business processes thatspecifically prohibit reidentification of the information; (iii) has implemented business processes toprevent inadvertent release of Deidentified Information; and (iv) will make no attempt to reidentify
the information.

5.

Security.
5.1.
Each Party hereby represents and warrants that it shall implement and maintain no less thanreasonable security procedures and practices, appropriate to the nature of the information, toprotect Partner-Provided Personal Information from unauthorized access, destruction, use,modification, or disclosure and to preserve the security and confidentiality of Partner-Provided
Personal Information in accordance with the CCPA or any other applicable data protection
legislation.

6.

Data Subject Rights
6.1.
Each Party is, in its role as separate Business, individually responsible for fulfilling its obligations
under the CCPA to comply with Consumer requests to exercise their rights regarding PartnerProvided Personal Information.

7.

Sale of Information.
7.1.
The Parties acknowledge and agree that the exchange of Personal Information between the Parties
does not form part of any monetary or other valuable consideration exchanged between the Parties
with respect to the Agreement or this Addendum.

8.

Certification.
8.1.
Each Party hereby certifies that it understands the restrictions and requirements in this Addendum
and will comply with them.

NortonLifeLock Inc.

Partner

Name:

Name:

Title:

Title:

Address:

Address:

Signature:

Signature:

Date:

Date: