CCPA/CPRA: the evidence behind every control
30 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
Business Obligations
1798.100(c)Data Minimisation, Necessity and Proportionality hardCCR §7012Notice at Collection Drafting Requirements hardCCR §7025Opt-Out Preference Signal Configuration moderate§1798.100General Duties of Businesses that Collect Personal Information hard§1798.130(a)(3)Privacy Policy Content Requirements moderate§1798.130(a)(5)(C)Notice at Collection hard§1798.135(a)Do Not Sell or Share My Personal Information Link hard§1798.135(b)Opt-Out Preference Signals (Global Privacy Control) moderate§1798.185(a)(15)Risk Assessments for High-Risk Processing hardConsumer Rights
CCR §7026Requests to Opt-Out of Sale/Sharing Handling moderate§1798.105Right to Delete Personal Information hard§1798.106Right to Correct Inaccurate Personal Information hard§1798.110Right to Know Categories and Specific Pieces of Personal Information Collected hard§1798.115Right to Know Personal Information Sold or Shared and Recipients hard§1798.120Right to Opt Out of Sale or Sharing of Personal Information hard§1798.125Non-Discrimination for Exercise of Rights hard§1798.135(c)Authorized Agent Requests moderate§1798.185(a)(16)Automated Decisionmaking Technology Access and Opt-Out hardSensitive PI
CCR §7027Requests to Limit Use of Sensitive PI Handling hard§1798.121Right to Limit Use and Disclosure of Sensitive Personal Information hardService Provider
CCR §7050Service Provider and Contractor Obligations hard§1798.100(d)Contractual Requirements for Third Parties, Service Providers, and Contractors hardPrivacy Operations
CCR §7060Consumer Identity Verification hardCCR §7100-7102Recordkeeping Requirements moderate§1798.130(a)(1)Designated Methods for Submitting Consumer Requests hard§1798.130(a)(2)45-Day Response Window and Identity Verification moderate§1798.130(c)Annual Metrics Disclosure (Large Businesses) hard