CCR §7026 Requests to Opt-Out of Sale/Sharing Handling
A business shall act upon a request to opt out as soon as feasibly possible, but no later than 15 business days from the date of receipt. Business shall notify all third parties to whom it has sold or shared PI within 90
4
artefacts
1
held by a system
0
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- 90-day downstream notification log to third parties · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Opt-out SLA tracking (15 business days) · Vendor register / contract repository
- Adtech partner suppression confirmation · Document repository
- No-account-required workflow · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Downstream notifications not sent
- Opt-out exceeds 15 business days
- Account creation required to opt out
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCCR §7025 Opt-Out Preference Signal Configuration · CCR §7027 Requests to Limit Use of Sensitive PI Handling