CCPA

Requirements and controls

• Statute California Consumer Privacy Act (Civil Code 1798.100 to 1798.199.100)

  • 1798.100 General duties of businesses that collect personal information

    • 1798.100(a) Notice at collection

      At or before collection, consumers are told which categories of personal and sensitive personal information are collected, for what purposes, whether it is sold or shared and how long each category is kept, and no new categories or incompatible purposes are added without a new notice.

      • Privacy Notices on Data Collection Forms
      • Published Privacy Policy
      • Personal Data Inventory

    • 1798.100(c) Necessary and proportionate processing

      Collecting, using, keeping and sharing personal information is reasonably necessary and proportionate to the purposes disclosed, or to compatible purposes.

      • Personal Data Inventory
      • Privacy by Design Policy
      • Data Retention Policy

    • 1798.100(d) Agreements with recipients of personal information

      Selling or sharing personal information with a third party, or disclosing it to a service provider or contractor, requires an agreement that limits its use to specified purposes, requires the same level of protection, lets the business check and stop misuse and requires notice if the recipient can no longer comply.

      • Processor Data Protection Agreements
      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments

    • 1798.100(e) Reasonable security

      Reasonable security procedures and practices suited to the nature of the information protect it from unauthorised or illegal access, destruction, use, modification or disclosure.

      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Production Database Access Restriction
      • Multi-Factor Authentication
      • Vulnerability Remediation Process

  • 1798.105 Right to delete

    Consumers can ask the business to delete personal information collected from them; verified requests are carried out and passed on to service providers, contractors and third parties that received the data, subject to the listed exceptions.

    • Data Subject Requests
    • Processor Data Protection Agreements
    • Data Retention Policy

  • 1798.106 Right to correct

    Consumers can ask the business to correct inaccurate personal information, and it uses commercially reasonable efforts to do so.

    • Data Subject Requests

  • 1798.110 Right to know what is collected

    Consumers can request the categories and specific pieces of personal information collected about them, its sources, the purposes and the categories of recipients.

    • Data Subject Requests
    • Personal Data Inventory

  • 1798.115 Right to know about sale, sharing and disclosure

    Consumers can learn which categories of their information were sold, shared or disclosed for a business purpose and to which categories of recipients, and third parties cannot pass it on again without notice and a chance to opt out.

    • Data Subject Requests
    • Personal Data Inventory
    • Opt-Out of Sale/Sharing & Limit Use Requests

  • 1798.120 Right to opt out of sale or sharing

    • 1798.120(a) Opting out of sale or sharing

      Consumers can tell the business at any time not to sell or share their personal information, the business gives notice of this right, and once told it stops until the consumer consents again.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • 1798.120(c) Opt-in for consumers under 16

      Personal information of consumers the business knows are under 16 is not sold or shared unless consumers aged 13 to 15, or a parent or guardian for those under 13, have opted in.

      • Children's Personal Data Safeguards
      • Opt-Out of Sale/Sharing & Limit Use Requests

  • 1798.121 Right to limit use of sensitive personal information

    Consumers can limit the use and disclosure of their sensitive personal information to what is needed to provide the goods or services they expect, and the business gives notice of other uses and honours the limit.

    • Opt-Out of Sale/Sharing & Limit Use Requests
    • Personal Data Inventory

  • 1798.125 No retaliation and financial incentives

    • 1798.125(a) No discrimination or retaliation

      Consumers, employees, job applicants and contractors are not discriminated or retaliated against for exercising their rights, for example through denial of service, different prices or lower quality.

      • Data Subject Requests
      • Data Protection Policy & Procedure

    • 1798.125(b) Financial incentive programs

      Financial incentives linked to personal information are disclosed, offered only with prior opt-in consent that can be revoked at any time, and are never unjust, coercive or usurious.

      • Consent Management
      • Published Privacy Policy

  • 1798.130 Notice, disclosure, correction and deletion requirements

    • 1798.130(a)(1) Methods for submitting requests

      At least two designated methods, including a toll-free number, let consumers submit requests to know, delete and correct, with the website used too where one exists and an email address sufficient for online-only businesses.

      • Data Subject Requests
      • Published Privacy Policy
      • Incident Reporting Assistance

    • 1798.130(a)(2) Answering requests within 45 days

      Verifiable requests are answered free of charge within 45 days, extendable once by 45 days with notice, without forcing consumers to create an account, and information is delivered in a portable format.

      • Data Subject Requests

    • 1798.130(a)(5) Privacy policy disclosures updated every 12 months

      The online privacy policy describes consumer rights and how to submit requests and lists the categories of information collected, sources, purposes and recipients, and what was sold, shared or disclosed, and it is updated at least every 12 months.

      • Published Privacy Policy
      • Conspicuous Privacy Notice Link
      • Management Review of Policies

    • 1798.130(a)(6) Informed staff for consumer inquiries

      Everyone responsible for handling consumer privacy inquiries knows the requirements of the Act and how to direct consumers to exercise their rights.

      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • 1798.130(a)(7) Use of verification information

      Information collected to verify a consumer's request is used only for verification and is not kept longer than needed for it.

      • Data Subject Requests
      • Data Retention Policy

  • 1798.135 Methods of limiting sale, sharing and use of sensitive information

    • 1798.135(a) 'Do Not Sell or Share' and 'Limit' links

      Businesses that sell or share personal information, or use sensitive personal information beyond permitted purposes, put clear and conspicuous 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information' links, or one combined link, on their homepages.

      • Opt-Out of Sale/Sharing & Limit Use Requests
      • Conspicuous Privacy Notice Link

    • 1798.135(b) Opt-out preference signals

      As an alternative to the links, a business may honour opt-out preference signals sent with the consumer's consent by a browser or similar mechanism, with any page asking to ignore the signal easy to revoke and not degrading the visit.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • 1798.135(c) Handling opt-out and limit requests

      Opting out requires no account or unnecessary information, the rights are described in the privacy policy, requests are honoured with at least 12 months before asking again, and information given with a request is used only to comply with it.

      • Opt-Out of Sale/Sharing & Limit Use Requests
      • Published Privacy Policy

  • 1798.150 Liability for breaches caused by inadequate security

    Consumers can sue when their unencrypted and unredacted personal information is breached because the business failed to keep reasonable security, so encryption and sound security practices reduce this exposure.

    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Full Device Encryption
    • Vulnerability Remediation Process
    • Breach Risk Assessment & Notification

• Regulations CCPA Regulations (Cal. Code Regs. tit. 11, 7000 et seq.)

  • Article 1 General provisions

    • § 7002 Purpose limitation and consumer expectations

      Collection and use of personal information are reasonably necessary and proportionate to purposes consistent with what consumers would reasonably expect, or compatible with them; otherwise the consumer's consent is needed.

      • Personal Data Inventory
      • Privacy by Design Policy
      • Data Protection Impact Assessments

    • § 7003 Clear and accessible disclosures

      Notices and other communications to consumers are easy to read and understand, offered in the languages the business uses with consumers, accessible to people with disabilities and readable on the device in use.

      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • § 7004 Choices without dark patterns

      Methods for submitting requests and giving consent are easy to understand and use, give symmetrical choices and avoid confusing or manipulative design; consent obtained through dark patterns does not count.

      • Consent Management
      • Privacy by Design Policy
      • Opt-Out of Sale/Sharing & Limit Use Requests

  • Article 2 Required disclosures to consumers

    • § 7011 Privacy policy

      The privacy policy fully describes online and offline practices, consumer rights and how to exercise them, categories, sources, purposes and recipients, and is posted and linked conspicuously.

      • Published Privacy Policy
      • Conspicuous Privacy Notice Link

    • § 7012 Notice at collection

      The notice at collection is given at or before the point of collection, online or offline, lists the categories, purposes, sale or sharing and retention, and links to the opt-out and the privacy policy.

      • Privacy Notices on Data Collection Forms
      • Published Privacy Policy

    • § 7013 Notice of the right to opt out of sale or sharing

      Businesses that sell or share personal information give notice of the right to opt out, with a 'Do Not Sell or Share' or alternative link that takes the consumer straight to the opt-out.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7014 Notice of the right to limit

      Businesses that use sensitive personal information beyond permitted purposes give notice of the right to limit and a 'Limit the Use' or alternative link.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7016 Notice of financial incentive

      A financial incentive comes with a notice summarising its terms, how to opt in and withdraw, and how the value of the consumer's data was estimated.

      • Consent Management
      • Published Privacy Policy

  • Article 3 Handling consumer requests

    • § 7020 Methods for submitting requests

      Request methods reflect how the business interacts with consumers, and requests sent through other channels are processed or the consumer is told how to submit them.

      • Data Subject Requests
      • Incident Reporting Assistance

    • § 7021 Confirming and answering requests

      Requests to delete, correct and know are acknowledged within 10 business days and answered within 45 calendar days, extendable to 90 with notice and a reason.

      • Data Subject Requests

    • § 7022 Carrying out deletion requests

      Verified deletion requests are completed by erasing, de-identifying or aggregating the data, telling service providers, contractors and third parties to delete it, and explaining any denial.

      • Data Subject Requests
      • Processor Data Protection Agreements
      • Media Disposal Policy

    • § 7023 Carrying out correction requests

      Correction requests are assessed against all the available information, corrections are applied across systems and passed on to recipients, and denials are explained.

      • Data Subject Requests

    • § 7024 Answering requests to know

      Responses give the specific pieces and categories of information required for the period covered, without disclosing data such as government identifiers or account passwords.

      • Data Subject Requests
      • Personal Data Inventory

    • § 7025 Honouring opt-out preference signals

      A valid opt-out preference signal, such as Global Privacy Control, is processed as a request to opt out of sale or sharing for that browser or device and any consumer known to be linked to it.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7026 Requests to opt out of sale or sharing

      Opt-out methods are easy and need few steps, requests are honoured within 15 business days and passed to third parties that received the data, and no identity verification is demanded for them.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7027 Requests to limit use of sensitive information

      Requests to limit are honoured within 15 business days, after which sensitive personal information is used only for the purposes the regulations allow, and service providers are told.

      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7028 Opting back in

      Consumers who opted out or limited use can opt back in only through a two-step process in which they request and then separately confirm their choice.

      • Opt-Out of Sale/Sharing & Limit Use Requests
      • Consent Management

  • Article 4 Service providers, contractors and third parties

    • § 7050 Limits on service providers and contractors

      Service providers and contractors use personal information only for the business purposes in their contract and the uses the regulations permit.

      • Processor Data Protection Agreements
      • Vendor Management Policy & Procedure

    • § 7051 Contract terms for service providers and contractors

      Contracts with service providers and contractors forbid selling or sharing the data, limit use to specified purposes, require compliance with the Act, allow reasonable oversight and require notice of non-compliance and flow-down to subcontractors.

      • Processor Data Protection Agreements
      • Vendor Management Policy & Procedure
      • Subservice Organization Evaluation

    • § 7053 Contract terms for third parties

      Businesses that sell or share personal information sign agreements with each third party that specify the limited purposes, require compliance and protection, and let the business check and stop unauthorised use.

      • Processor Data Protection Agreements
      • Opt-Out of Sale/Sharing & Limit Use Requests
      • Vendor Management Policy & Procedure

  • Article 5 Verification of requests

    • § 7060 Verifying consumer identity

      A reasonable, documented method verifies requesters by matching information against data already held, with stricter verification for more sensitive data and without collecting new data where possible.

      • Data Subject Requests

    • § 7063 Authorized agents

      Requests made through an authorised agent are accepted with proof of signed permission, and the business may ask the consumer to verify their identity or confirm the permission directly.

      • Data Subject Requests

  • Article 6 Consumers under 16

    • § 7070 Consumers under 13

      A business that knowingly sells or shares the data of children under 13 uses a documented, reasonable method to confirm that the person consenting is the child's parent or guardian.

      • Children's Personal Data Safeguards

    • § 7071 Consumers aged 13 to 15

      Consumers aged 13 to 15 can opt in to the sale or sharing of their data through a documented process and are told they can opt out again at any time.

      • Children's Personal Data Safeguards
      • Opt-Out of Sale/Sharing & Limit Use Requests

    • § 7072 Privacy policy for minors

      Businesses covered by the rules for minors describe their opt-in processes in the privacy policy.

      • Children's Personal Data Safeguards
      • Published Privacy Policy

  • Article 7 Non-discrimination

    • § 7080 Price or service differences

      Any difference in price or service linked to the exercise of privacy rights must be reasonably related to the value of the consumer's data, estimated in good faith with a documented method, or it is not allowed.

      • Consent Management
      • Data Subject Requests

  • Article 8 Training and record-keeping

    • § 7100 Training

      Staff handling consumer inquiries know the Act and regulations, and businesses dealing in the data of 10 million or more consumers a year keep a documented training policy.

      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training
      • Information Security & Privacy Policies

    • § 7101 Keeping request records for 24 months

      Records of consumer requests and responses, with the dates, nature, channel and any reason for denial, are kept securely for at least 24 months.

      • Data Subject Requests
      • Data Retention Policy

    • § 7102 Yearly metrics for large-volume businesses

      Businesses dealing in the data of 10 million or more consumers a year compile metrics on the requests received, granted and denied and their response times, and publish them by 1 July each year.

      • Data Subject Requests
      • Published Privacy Policy

  • Article 9 Cybersecurity audits

    • § 7120 When a cybersecurity audit is required

      A cybersecurity audit is required from businesses that earn half or more of their revenue from selling or sharing personal information, or that exceed the revenue threshold and processed the data of 250,000 consumers or the sensitive data of 50,000 consumers in the previous year.

      • Annual Cybersecurity Audit & Certification

    • § 7121 Audit timing

      The first audit report is due by 1 April 2028, 2029 or 2030 depending on annual revenue, then every year, each covering the previous twelve months.

      • Annual Cybersecurity Audit & Certification

    • § 7122 Independence and thoroughness of the audit

      A qualified, objective and independent auditor conducts the audit using recognised procedures and specific evidence; an internal auditor reports to an executive who has no direct responsibility for the cybersecurity program.

      • Annual Cybersecurity Audit & Certification
      • Internal Audit

    • § 7123 Scope of the audit and audit report

      The audit assesses the cybersecurity program and the components the regulation lists, such as authentication, encryption, access control, inventories, secure configuration, vulnerability management, logging, training, vendor oversight and incident response, and the report records gaps and remediation.

      • Annual Cybersecurity Audit & Certification
      • Internal Audit
      • Security & Privacy Program Review

    • § 7124 Certification of completion

      A member of executive management submits a written certification to the Agency each year that the cybersecurity audit was completed.

      • Annual Cybersecurity Audit & Certification

  • Article 10 Risk assessments

    • § 7150 When a risk assessment is required

      A risk assessment is done before selling or sharing personal information, processing sensitive data, using automated decisionmaking technology for significant decisions, making certain automated inferences about people, or training such technology.

      • Data Protection Impact Assessments
      • Risk Assessment

    • § 7151 Involving stakeholders

      Employees who take part in the processing contribute to its risk assessment, and external parties may be involved where useful.

      • Data Protection Impact Assessments

    • § 7152 Content of a risk assessment

      The assessment documents the purpose, the categories of data, how the processing works, its benefits, the negative impacts on consumers, the safeguards planned and the decision whether to proceed, with the people who approved it.

      • Data Protection Impact Assessments

    • § 7155 Timing and retention of risk assessments

      Assessments are done before the processing starts (by 31 December 2027 for processing already under way in 2026), reviewed every three years and within 45 days of a material change, and kept for five years or as long as the processing continues.

      • Data Protection Impact Assessments

    • § 7157 Submission to the Agency

      Information on the risk assessments conducted, with an executive certification, is submitted to the Agency by 1 April 2028 for 2026 and 2027, and by 1 April of each following year.

      • Data Protection Impact Assessments
      • Statutory, Regulatory & Contractual Compliance

  • Article 11 Automated decisionmaking technology

    • § 7200 Use of ADMT for significant decisions

      Businesses that use automated decisionmaking technology to make significant decisions about consumers meet the ADMT rules, from 1 January 2027 for uses that began earlier.

      • Data Protection Impact Assessments
      • Personal Data Inventory

    • § 7220 Pre-use notice

      Before processing personal information with the technology for a significant decision, consumers receive a notice explaining the purpose, how it works and their rights to opt out and to access information about it.

      • Privacy Notices on Data Collection Forms
      • Published Privacy Policy

    • § 7221 Opting out of ADMT

      Consumers can opt out of the use of the technology for significant decisions, unless an exception such as an appeal to a qualified human reviewer applies, and opt-outs are honoured within 15 business days.

      • Data Subject Requests
      • Consent Management

    • § 7222 Access to ADMT information

      On request, consumers receive a plain-language explanation of why the technology was used for them, how its logic works and what the outcome was.

      • Data Subject Requests