CCR 7023 Assess and handle correction requests, documentation and denials
The business weighs the totality of circumstances about the disputed data, must accept and consider documents the consumer supplies, and may ask for documentation where needed. Once corrected the data must stay corrected, with service providers and contractors told to correct their copies. Deletion may replace correction if it does not harm the consumer or the consumer agrees. Denials must be explained, with the consumer told of any right to a written statement contesting the data where the disputed data concerns the consumer's health (a statement of up to 250 words added to the record), and the business may refuse repeat requests on the same point within six months or fraudulent or abusive ones. Where another party was the source, the business names that source.
Source: CCPA/CPRA, CCR 7023. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.
Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Correction decisions with the evidence considered and outcome · Document repository
- Records of consumer documentation received and how it was weighed · Document repository
governing documentDocuments that govern the control
- Communications naming the data source where the business did not originate the data · Document repository
- Process for recording a consumer statement disputing data that was not corrected · Document repository
First move
Common gaps auditors find
- Correction re-overwritten by upstream feeds because the source was not fixed
- Denials without the 250-word statement option where it applies
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCCR 7022 Carry out deletion requests completely and explain any denial · CCR 7024 Respond to requests to know: search scope, protected data and portals