The secretary of state shall enter into a written contractual agreement with the data processor notwithstanding the fact that the data processor may be a department of state government.