Exhibit B: Data Processing Addendum
Pursuant to the {{name_of_agreement}} dated {{date_of_agreement}} (“Agreement”) between NortonLifeLock Inc.
and its affiliates (“NortonLifeLock”), and {{third_party}} (“Vendor”) (each a “Party”; collectively the “Parties”), and in
furtherance of each Party’s obligations under the California Consumer Privacy Act of 2018 (California Civil Code §§1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”), andany other applicable data protection legislation in the United States, the Parties hereby adopt this Data Processing
Addendum (“Addendum”), which will remain in effect for so long as Vendor maintains Personal Information (asdefined below) on behalf of NortonLifeLock. This Addendum prevails over any conflicting terms of the Agreement.
1.

Definitions. For the purposes of this Addendum-1.1.
The capitalized terms used in this Addendum and not otherwise defined in this Addendum shallhave the definitions set forth in the CCPA, or in the applicable data protection legislation in theUnited States.
1.2.
“Services” means the services or products provided by Vendor pursuant to the Agreement.

2.

Roles and Scope.
2.1.
This Addendum applies only to the Collection, retention, use, disclosure, and Sale of PersonalInformation provided by NortonLifeLock to, or which is Collected on behalf of NortonLifeLock by,Vendor to provide Services to NortonLifeLock pursuant to the Agreement or to perform a Business
Purpose (“NortonLifeLock Personal Information”).
2.2.
The Parties acknowledge and agree that NortonLifeLock is a Business and appoints Vendor as aService Provider to process NortonLifeLock Personal Information at NortonLifeLock’s direction.

3.

Restrictions on Processing.
3.1.
Except as otherwise permitted by the CCPA or any other applicable data protection legislation in
the United States, Vendor is prohibited from (i) retaining, using, or disclosing NortonLifeLock
Personal Information for any purpose other than for the specific purpose of performing the Services
specified in the Agreement for NortonLifeLock, as set out in this Addendum; (ii) retaining, using, ordisclosing NortonLifeLock Personal Information outside of the direct business relationship between
Vendor and NortonLifeLock; and (iii) selling NortonLifeLock Personal Information.

4.

Consumer Rights.
4.1.
Vendor shall provide commercially reasonable assistance to NortonLifeLock for the fulfillment of
NortonLifeLock’s obligations to respond to CCPA or other Consumer rights requests regarding
NortonLifeLock Personal Information.
4.2.
Upon direction by NortonLifeLock, and in any event no later than 30 days after receipt of a requestfrom NortonLifeLock, Vendor shall promptly delete NortonLifeLock Personal Information as directedby NortonLifeLock.
4.3.
Vendor shall not be required to delete any NortonLifeLock Personal Information to comply with aConsumer’s request directed by NortonLifeLock if it is necessary to maintain such information inaccordance with the CCPA or other applicable data protection legislation, in which case Vendor
shall promptly inform NortonLifeLock of the exceptions relied upon to retain NortonLifeLock
Personal Information. Vendor shall not use NortonLifeLock Personal Information retained for any
other purpose than provided for by that exception.

5.

Deidentified Information.
5.1.
In the event that any Party shares Deidentified Information with another Party, the receiving Party
warrants that it: (i) has implemented technical safeguards that prohibit reidentification of theConsumer to whom the information may pertain; (ii) has implemented business processes thatspecifically prohibit reidentification of the information; (iii) has implemented business processes toprevent inadvertent release of Deidentified Information; and (iv) will make no attempt to reidentify
the information.

6.

Security
6.1.
Vendor hereby represents and warrants that it will protect NortonLifeLock Personal Informationfrom unauthorized access, destruction, use, modification, or disclosure (“Security Incident”) andpreserve the security and confidentiality of NortonLifeLock Personal Information in accordance withthe CCPA, or any other applicable data protection legislation in the United States.
6.2.
Vendor shall provide written responses (on a confidential basis) to all reasonable requests for
information made by NortonLifeLock, including responses to information security and audit
questionnaires, that are necessary to confirm Vendor’s compliance with the CCPA or any otherapplicable data protection legislation, and this Addendum.
6.3.
Upon becoming aware of an actual or reasonably suspected Security Incident, Vendor shall notify
NortonLifeLock without undue delay and shall provide timely updates and information relating to theSecurity Incident as it becomes known or as is reasonably requested by NortonLifeLock. Suchinformation will include the nature of the Security Incident, the categories and number ofConsumers affected, the categories and amount of NortonLifeLock Personal Information affected,
the likely consequences of the Security Incident, and the measures taken or proposed to be taken
to address the Security Incident and mitigate possible adverse effects.
7.

Sale of Information.
7.1.
The Parties acknowledge and agree that the exchange of Personal Information between the Parties
does not form part of any monetary or other valuable consideration exchanged between the Parties
with respect to the Agreement or this Addendum.

NortonLifeLock, Inc.

Vendor

Name:

Name:

Title:

Title:

Address:

Address:

Signature:

Signature:

Date:

Date: