CCR 7222 Answer requests to access ADMT information
From the Article 11 date, on a verified request the business must explain in plain language the specific purpose for which ADMT was used about the consumer, the logic and parameters behind the output for that consumer, the output itself, how it was used to reach the decision (and any planned future use), the bar on retaliation, and how to exercise other rights. Existing request channels may be used, the response follows the section 7021 timelines and verification rules, denials must be explained, delivery must be secure, and frequent use (more than four times in 12 months) may be answered at aggregate level. Service providers and contractors must help.
Source: CCPA/CPRA, CCR 7222. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.
Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Per-consumer output records retained to support responses · Document repository
governing documentDocuments that govern the control
- Access response template covering purpose, logic, output and decision use · Document repository
- Verification record at the reasonably high standard before release · Policy repository / GRC workspace
First move
Common gaps auditors find
- Outputs not logged, so individual responses cannot be produced
- Responses give generic model descriptions rather than the consumer's own result
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCCR 7221 Offer an opt-out of ADMT, or a qualifying human appeal