CCPA/CPRA: the evidence behind each requirement
57 sections. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).
General duties: notice at collection, purpose limitation and security
1798.100(a)Inform consumers at or before collection moderate1798.100(c)Keep collection and use necessary and proportionate hard1798.100(e)Maintain reasonable security for personal information moderateCCR 7002Purposes must match reasonable expectations, or consent is needed hardService providers, contractors and third parties
1798.100(d)Put an agreement in place with every recipient of personal information hardCCR 7050Service providers and contractors: permitted uses and cooperation hardCCR 7051Service provider and contractor contract terms hardCCR 7053Third-party contract terms for sale or sharing hardRequests to know, delete and correct
1798.105(c)Delete on a verified request and pass deletion on hard1798.106(c)Correct inaccurate personal information hard1798.110(b)Disclose collected personal information on a verified request moderate1798.115(b)Disclose sales, sharing and business-purpose disclosures on request hard1798.130(a)(1)Offer designated methods for requests to know, delete and correct moderate1798.130(a)(2)Answer verified requests within 45 days, free of charge moderateCCR 7021Confirm receipt within 10 business days and respond within 45 calendar days moderateCCR 7022Carry out deletion requests completely and explain any denial hardCCR 7023Assess and handle correction requests, documentation and denials hardCCR 7024Respond to requests to know: search scope, protected data and portals moderateOpt-out of sale or sharing, limiting sensitive data and preference signals
1798.120Honour the right to opt out of sale or sharing hard1798.121Honour the right to limit use of sensitive personal information hard1798.135(a)Post the opt-out and limit links, or a single alternative link hard1798.135(c)Run opt-out and limit requests without friction or reuse moderate1798.136Browsers must offer an opt-out preference signal setting (from 1 January 2027) hardCCR 7013Notice of right to opt out of sale or sharing hardCCR 7014Notice of right to limit sensitive personal information hardCCR 7025Process opt-out preference signals hardCCR 7026Handle requests to opt out of sale or sharing moderateCCR 7027Handle requests to limit use of sensitive personal information moderateCCR 7028Opt back in through a two-step process only hardVerification, agents, minors and non-discrimination
1798.120(c)Obtain opt-in before selling or sharing data of consumers under 16 hard1798.125(a)Do not discriminate or retaliate against consumers who use their rights hard1798.125(b)Offer financial incentives only with notice and opt-in consent hardCCR 7060Verify identity for requests to know, delete, correct and access ADMT hardCCR 7063Accept requests from authorised agents moderateCCR 7081Calculate and document the value of consumer data hardPrivacy policy, notices and choice design
1798.130(a)(5)Disclose rights and data practices in the privacy policy, refreshed yearly hardCCR 7003Make disclosures readable, accessible and linked conspicuously hardCCR 7004Design request and consent flows without dark patterns moderateCCR 7011Privacy policy format, placement and required contents moderateCCR 7012Notice at collection: content, placement and third-party collection hardTraining, record-keeping and annual metrics
CCR 7100Train staff who handle privacy enquiries moderateCCR 7101Keep records of consumer requests for 24 months easyCCR 7102Publish annual request metrics if handling data of 10 million or more consumers moderateCybersecurity audits (11 CCR Article 9)
CCR 7120Complete a cybersecurity audit where processing poses significant security risk hardCCR 7121Meet the cybersecurity audit timetable hardCCR 7122Use a qualified, objective and independent auditor working from evidence hardCCR 7123Scope the audit across the 18 programme components and report fully hardCCR 7124Certify completion of the cybersecurity audit to the CPPA hardRisk assessments (11 CCR Article 10)
CCR 7150Conduct a risk assessment before high-risk processing hardCCR 7151Involve the people who run the processing hardCCR 7152Document the risk assessment content and approval hardCCR 7153Give ADMT customers the facts they need for their own assessment hardCCR 7155Review risk assessments every three years and after material change moderateCCR 7157Submit risk assessment information and attestation to the CPPA hard