What evidence do auditors commonly ask for on 1798.110(b) Disclose collected personal information on a verified request?

Data discovery procedure listing every system searched for an access request; Sample access response packages showing categories and specific pieces; Machine-readable export format used for responses.

What is the most common gap auditors find on 1798.110(b)?

Data held by service providers omitted from responses

CCPA/CPRA · Requests to know, delete and correct

`1798.110(b)` Disclose collected personal information on a verified request

When a consumer makes a verifiable request, the business must tell them the categories of personal information it holds on them, the categories of sources, the purposes for collecting, selling or sharing, the categories of third parties receiving it, and the specific pieces of data it collected, including through service providers or contractors, in an understandable and, where technically feasible, structured machine-readable form (1798.130(a)(3)).

Source: CCPA/CPRA, 1798.110(b). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

artefacts

held by a system

at each review

moderate

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Machine-readable export format used for responses · Document repository

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Data discovery procedure listing every system searched for an access request · Policy repository / GRC workspace
Sample access response packages showing categories and specific pieces · Document repository

First move

Start with the 1 of 3 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Data held by service providers omitted from responses
Generic policy text sent instead of an individual response

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

1798.106(c) Correct inaccurate personal information · 1798.115(b) Disclose sales, sharing and business-purpose disclosures on request