California Privacy Rights Act Timeline and Implementation Guide

Convert CPRA duties into an operating model for correction rights, SPI controls, service provider and contractor governance, and the California rules effective January 1, 2026.

CPRA generally applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenues over $25 million, buying/selling/sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenues from selling or sharing personal information. Grounded in the current California statute, CPPA regulations, and CPPA rulemaking updates. This is implementation guidance, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation.