US CPRA Compliance

Begin with a dated scope decision for each legal entity. Record the California nexus, preceding-year threshold calculation, common-control and common-branding analysis, and every exemption by data set. Revisit that record after acquisitions, reorganizations, new California activity, and each annual close.

Build the program around actual data flows. For each category of personal information, record the source, disclosed purpose, system, retention rule, sale or sharing status, sensitive-information status, and recipient role. Use that inventory to control the notice at collection, privacy policy, request search, opt-out propagation, deletion, correction, and contract instructions.

Keep Delete Act duties in a separate lane. Registration and DROP obligations apply to businesses that meet California's data-broker definition; they are adjacent California law, not a requirement for every CCPA-covered business.

Notices should match actual collection, purposes, retention, sale, and sharing. For requests to know, delete, and correct, consumer-rights evidence should show intake, verification, confirmation within 10 business days, the response within 45 calendar days or the explained extension of up to 45 additional days, system actions, recipient instructions, and the reason for any partial or full denial. Start the 45-day clock on receipt, not after verification or internal assignment.

For sale or sharing, retain the public opt-out method, opt-out preference signal tests, downstream instructions, and proof that the choice persists as required. Stop sale or sharing as soon as feasibly possible and no later than 15 business days after receiving the request, and notify relevant third parties within that period. For sensitive personal information, document whether each use falls within a permitted purpose or triggers the right to limit; that request has its own 15-business-day operational limit.

Keep request records for at least 24 months. The log should show the request date and type, intake method, response date and result, and the basis for any denial, without retaining personal information solely for recordkeeping beyond what is necessary.

Do not turn an information-specific exemption into an entity-wide exclusion. Health, financial, credit-reporting, and other regulated data require a provision-by-provision analysis. Employment and business-contact information are no longer covered by the temporary exemptions that ended after 2022.

A vendor's title does not decide its role. If the written agreement or actual use falls outside the service-provider or contractor rules, the disclosure may be a sale or sharing and may trigger notice, opt-out, and third-party contract duties.

The regulations adopted in 2025 became effective January 1, 2026, but their operational dates are phased. Risk assessments for existing covered processing, first submissions, cybersecurity-audit reports and certifications, and ADMT compliance do not all share one deadline.

Use a control register with one row per obligation and fields for the legal trigger, affected entity and processing, owner, system action, evidence, exception, deadline, test result, and next review. Link each control to the source provision and the data flow it governs.

Review before launch and after material changes to collection, purpose, retention, advertising, recipient roles, consumer interfaces, security architecture, or ADMT. Run periodic tests on request timing, correction and deletion propagation, opt-out preference signals, contract instructions, and public notices.