Account clauses an agency should propose in its client contract

These five clauses are written from your agency’s side of the contract. Each one keeps the promises your agency can keep on its own apart from the steps only the client can take. The client’s side of the same question is covered in What your vendor contract should say about accounts.

Why bring your own draft

Clients covered by the California Consumer Privacy Act (CCPA) have to put certain terms in your contract. If you process consumers’ personal information for a client that is a CCPA “business,” it must have an agreement with you (Cal. Civ. Code 1798.100(d)). The regulations list what that agreement must say (11 CCR 7051(a)). Among other terms, it must name the specific business purposes of your work, rather than pointing to the whole contract (7051(a)(2)). It must give the client the right to take reasonable steps to check your use of the data (7051(a)(6)). Those steps may include assessments or audits at least once every 12 months. And it must let the client, after notice, stop and fix unauthorized use (7051(a)(8)).

The client will bring those terms. Your draft is for something else: promises you can’t keep alone. Delegated access, where the owner invites your staff through the platform, starts on the client’s side. Some platforms let you manage your own staff. In Google Ads, users of your manager account are added and removed under Access and security in that account. On platforms without such a feature, adding and removing your staff happens in the client’s account. A clause that says “Agency will cut off access the day someone leaves” fails whenever the client is slow.

Platform rules matter too. Meta’s Terms of Service ask Facebook users to “not share your password, give access to your Facebook account to others,” without Meta’s permission (section 3.1). YouTube Help says “Don’t share passwords or sign-in info with anyone else,” and that channel access should come only through accounts authorized with channel permissions. A clause that has the client send you those logins asks both sides to work against the platform’s own rules.

Watch the level of security you agree to. The CCPA regulations give, as one example of a contract term, “reasonable security procedures and practices appropriate to the nature of the personal information” (11 CCR 7051(a)(5)). A client may ask you to follow its own internal security policy instead. That is a business term, not a legal requirement, so check you can meet it before you sign.

Five clauses with sample wording

The samples below are illustrative drafting, not legal advice and not taken from any company’s contract. They’re written to sit in a master services agreement (MSA) or a statement of work (SOW). Section numbers assume the clauses sit in Section 7 of your MSA. These defined terms apply throughout:

“Client Accounts” means accounts on third-party platforms (“Platforms”) that Client owns and that Agency uses to perform the Services. “Authorized Personnel” means the Agency employees, and any subcontractors approved under Section 7.3, who are permitted to use Client Accounts.

1. How accounts are handed over, and what the client does

7.1 Access Method. For each Client Account on a Platform that supports user invitations or partner access, Client will grant access by inviting Agency’s business or manager account, or individual Authorized Personnel, at the permission level stated in the applicable SOW. Client will provide a shared username and password only for a Client Account on a Platform with no such feature, and only by a method Client designates.

7.2 Client Changes. Where Agency cannot add or remove Authorized Personnel through its own account or manager account, Client will make the change within [two] business days after Agency’s written request. Agency is not responsible for delays in the Services caused by a change pending with Client.

Section 7.1 fixes the method before work starts. With invitations, each person signs in as themselves, and the platform’s history names the person, as far as the platform keeps history. Section 7.2 covers platforms where only the client can add or remove your staff. It keeps a slow change on the client’s side from becoming your breach.

2. Who may use the accounts, and subcontractors

7.3 Authorized Personnel. Agency will maintain a current list of Authorized Personnel for each Client Account, provide it to Client on request, and update it within [five] business days after any change. Agency will not permit any person other than an Agency employee, including an individual freelancer, to use a Client Account without Client’s prior written consent.

The list gives the client a way to see who is in its accounts. It also gives your agency written agreement on who may be. The consent step covers freelancers. The CCPA has its own rule here. If a service provider brings in another person to help process personal information for the business, it must notify the business. That engagement must be under a written contract that binds the other person to the same restrictions (1798.140(ag)(2); see also 11 CCR 7051(b)). With the steps written down, you know what to do before a busy month brings in outside help.

3. Records and reporting

7.4 Access Records. Agency will record which Authorized Personnel used each Client Account and when, and will retain those records during the Term and for [one] year after. Within [five] business days after Client’s written request, Agency will deliver the records in its possession.

“In its possession” matters because the records you can hand over depend on the access method. With invitations, the platform’s history names each person. With a shared login, the platform shows only the login, and the person comes from your own work log. If the client’s employees use the same login, the records can’t separate their actions from yours. In that case, add a sentence that Client will tell Agency before its own staff use a shared login. These records are also what you hand over when the client exercises its right to check your use of the data (7051(a)(6)).

4. Incident notice and cooperation

7.5 Security Incidents. Agency will notify Client within [24] hours after Agency becomes aware of any unauthorized use of a Client Account, or any actual or suspected disclosure of a username or password for a Client Account, and will cooperate with Client’s investigation. Client will promptly notify Agency of any change Client makes to a password, two-step verification setting, or permission for a Client Account.

Pick a number of hours your team can actually meet. Work out who notices a problem at night or on a weekend, and who sends the notice, before you fill in the blank. Separately, the contract the CCPA requires must oblige you to tell the business if you decide you can no longer meet your CCPA obligations (1798.100(d)(4); 11 CCR 7051(a)(7)).

The second sentence handles a different case. If the client changes a password and your staff are suddenly locked out, you need to know it was the client. Otherwise your team may treat it as a takeover.

5. Offboarding and the end of the contract

7.6 Personnel Changes. When any Authorized Personnel stop working on Client Accounts, Agency will remove that person’s access wherever Agency can do so through its own account or manager account. Within [two] business days after Agency’s request, Client will remove any access Agency cannot remove and change any password Client shared with Agency.

7.7 Termination. When this Agreement ends, Agency will remove all Authorized Personnel’s access that it can remove, delete any Client Account usernames and passwords it has stored, and confirm the date of removal and deletion to Client in writing. Client will then remove any remaining access and change any password Client shared with Agency, as in Section 7.6.

Section 7.6 lists your agency’s tasks and the client’s tasks separately. Where your manager account controls access, you can remove a person the same day. Elsewhere, removing access and changing shared passwords are the client’s actions. Without a request and a deadline in the contract, a departed staff member may keep access that your agency has no power to end. Section 7.7 applies once, when the contract ends, and adds deleting the logins you stored. The account handover checklist covers the steps on your side.

Rewrite the samples for your services and platforms, and have a lawyer review the final wording. This article is not legal advice.