US CCPA DSAR Workflow

At intake, record the request as received even if it arrives through a method not designed for that right. Route it to the responsible team, record the date and channel, identify the consumer or authorized-agent context, and state how the business will process the request. The 45-day period runs while verification is pending.

Use a reasonable verification method for delete, correct, know, ADMT access, and ADMT appeal requests. For an account holder, use existing account authentication when reasonable and require reauthentication before disclosure or deletion. For a non-account holder, match reliable data points and scale the certainty to the sensitivity and harm from unauthorized deletion, correction, or access. Verification information may be used only for verification. Opt-out, limit, and ADMT opt-out requests need a separate non-verifiable path.

Define the search from the requested right and the personal information the business maintains. Include systems that can retrieve the consumer's information and obtain required help from service providers or contractors. A request to know can reach information collected beyond the preceding 12 months when it was collected on or after January 1, 2022, unless the business proves that responding is impossible or would involve disproportionate effort.

For correction, consider the nature of the information, how it was obtained, and documentation the consumer provides. For deletion, identify which records are subject to a statutory exception, such as completing a transaction, security and integrity, legal compliance, or exercising legal claims, rather than treating an entire account or dataset as exempt. Delete, deidentify, or aggregate records that are not covered by an exception and send the required downstream instructions.

The response should state what the business did. If it denies all or part of a request, explain the basis in understandable terms and disclose the remainder when a partial response is possible. A business that cannot verify within 45 days may deny a request that requires verification, but it should retain the verification record and give the consumer the response required by the applicable section.

The record should reconstruct the case without relying on a team member's memory. Keep the original request, confirmation, clock calculations, extension notice, verification evidence, search scope, system and vendor actions, exception analysis, approvals, response, delivery evidence, and any complaint or appeal. CCPA request records must be kept for at least 24 months, but identity documents and disclosed personal information should not be retained longer than reasonably necessary for handling, review, security, and recordkeeping.

Review samples after changes to products, accounts, identity systems, retention, vendors, or request portals. The CPPA's enforcement advisory warns that request handling remains subject to data minimization, so remove intake fields and retained verification material that are not reasonably necessary and proportionate.