California Delete Act Data Broker Deletion Workflow
Data broker deletion workflow decisions under California privacy law should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.
This page helps teams decide how to build and document a deletion workflow, including who is in scope, what evidence to capture, and when to escalate exceptions. Confirm legal and policy assumptions before implementation.
Use this page to build a California data broker deletion workflow that shows who must act, what must be deleted, what evidence to retain, and when to escalate exceptions or review outcomes.
1
Section 1
How should a Data Broker Deletion Workflow run under the California CPRA?
Start with the governing rule, then check whether the business is a data broker, whether the request is a deletion request under Section 1798.99.86, and whether any exceptions or related opt-out rules apply before assigning the action and deadline.
Capture the request, product, role, data flow, jurisdiction, and deadline.
Check the source-linked rule and route exceptions before implementation.
Record the action taken, owner, reviewer, evidence location, and next review date.
Keep a plain-language output that support, product, legal, security, and compliance teams can all understand.
What fields should the Data Broker Deletion Workflow template capture?
A useful template captures business threshold, consumer/data category, request or signal type, vendor role, response deadline, notice/control evidence, and escalation reason.
Source URL and source quote so reviewers can trace the rule back to the official text.
Entity, product, service, system, data category, and user group.
Decision result, control action, owner, reviewer, due date, and escalation reason.
Evidence attachment, approval note, exception note, and review cadence.
How should teams review and improve the Data Broker Deletion Workflow?
Review the workflow after CPPA rulemaking updates, ad-tech changes, vendor changes, new data categories, consumer complaints, enforcement advisories, or material product changes.
Track recurring exception categories and update intake questions.
Remove fields that never affect the decision.
Add fields when reviews show missing source evidence or unclear ownership.
Confirm generated markdown and page content include the same visible source-linked guidance.
Turn California data broker deletion workflows into assigned work
This California Delete Act guide turns turn data broker deletion workflows into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.