EvidenceSheet
CCPA/CPRA · Requests to know, delete and correct

1798.130(a)(2) Answer verified requests within 45 days, free of charge

A business must deliver the required information, make the correction or carry out the deletion free of charge within 45 days after a verifiable request arrives, starting verification promptly without stopping the clock. It may extend once by a further 45 days where reasonably needed if it tells the consumer within the first period. Disclosures are made in writing, through the consumer's account or by mail or electronically, in a portable, readily usable format, and cover the prior 12 months, or longer on request for data collected on or after 1 January 2022 unless impossible or disproportionate. A business need not answer more than two access requests from one consumer in any 12 months (1798.130(b)).

Source: CCPA/CPRA, 1798.130(a)(2). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

4
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

  • Request log with received date, verification date, response date and any extension notice · SIEM / log platform

periodic reviewEvidence produced at each review

  • Service-level report of response times against the 45-day limit · Document repository

governing documentDocuments that govern the control

  • Template response letters and extension notices · Document repository
  • Export format specification for portable data · Document repository

First move

Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

1798.130(a)(1) Offer designated methods for requests to know, delete and correct · 1798.130(a)(5) Disclose rights and data practices in the privacy policy, refreshed yearly