What evidence do auditors commonly ask for on 1798.100(a) Inform consumers at or before collection?

Notice-at-collection text for each collection channel (web forms, apps, stores, call centre, employee onboarding); Data map linking each personal information category to purpose, sale or sharing status and retention period; Retention schedule by personal information category with the criteria used where a fixed period is not set; Change log showing a new notice issued before any new category or new purpose went live.

What is the most common gap auditors find on 1798.100(a)?

Retention periods missing from the notice or stated as indefinite

CCPA/CPRA · General duties: notice at collection, purpose limitation and security

`1798.100(a)` Inform consumers at or before collection

Before or when it collects personal information, a business that controls that collection must tell consumers which categories it will collect, including any sensitive categories, why each is collected or used, whether each is sold or shared, and how long each category will be kept (or the criteria that set the period). It may not later gather new categories, or put existing data to purposes incompatible with those it announced, without first giving a fresh notice. A third party that controls collection may meet this by a prominent notice on its website homepage, and must give the notice at the location when it collects on premises (1798.100(b)).

Source: CCPA/CPRA, 1798.100(a). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

artefacts

held by a system

at each review

moderate

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Change log showing a new notice issued before any new category or new purpose went live · SIEM / log platform

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Notice-at-collection text for each collection channel (web forms, apps, stores, call centre, employee onboarding) · HR system / LMS
Data map linking each personal information category to purpose, sale or sharing status and retention period · Policy repository / GRC workspace
Retention schedule by personal information category with the criteria used where a fixed period is not set · Policy repository / GRC workspace

First move

Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Retention periods missing from the notice or stated as indefinite
Employee and applicant collection points given no notice
New tracking or data uses launched without updating the notice first

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

1798.100(c) Keep collection and use necessary and proportionate