Artifact GuideUSDeadlines and Compliance Calendar

US CPRA Deadlines and Compliance Calendar

Deadlines and Compliance Calendar decisions under the US CPRA should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

This page offers practical steps for implementation planning. Confirm legal and policy assumptions before implementation.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
May 9, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated May 9, 2026
Overview

This page explains US CPRA obligations for Deadlines and Compliance Calendar to the specific trigger, responsible role, deadline, evidence record, and review path that product, legal, privacy, security, and compliance teams can apply.

Section 1

Which US CPRA deadlines should teams track in the compliance calendar?

Track the concrete CPRA timing rules first: businesses must confirm receipt of delete, correct, or know requests within 10 business days, respond to those requests within 45 calendar days, and may extend that response period once for another 45 days with notice. Opt-out of sale or sharing and limit-use requests must be handled as soon as feasibly possible, up to 15 business days from receipt.

Also calendar recurring CPRA dates that affect operations, including the January 1, 2024 transfer of the Data Broker Registry to the Agency, the January 31 annual data broker registration deadline, the July 1 annual data broker website disclosure deadline, and the January 1, 2027 ADMT-specific compliance deadline. Keep the statutory/regulatory source, threshold calculation, data category, consumer-right workflow, opt-out signal handling, and contract evidence together so California privacy decisions are reviewable.

  • Define the exact Deadlines and Compliance Calendar trigger and the business process it affects.
  • Record which role, product, system, customer group, or data flow is in scope.
  • Attach the source-linked rule, the owner, and the evidence field before approving the control.
  • Escalate uncertainty when the facts depend on thresholds, exemptions, cross-border activity, vulnerable users, or enforcement-sensitive wording.
Sources for this answer
California Consumer Privacy Act Regulations (March 2023)
CPPA regulations source for operative compliance duties, including timing and workflow requirements that belong on the CPRA calendar.
California Privacy Protection Agency FAQ
CPPA FAQ source for explaining which CPRA amendments added consumer rights and business obligations teams must track.
California legislative bill text
California Delete Act source for data-broker calendar items that should be tracked separately from core CPRA rights work.
Section 2

Who should own Deadlines and Compliance Calendar, and what evidence should prove the decision?

Ownership should sit with the team that can change notices, rights intake, consent/opt-out interfaces, data sharing, retention, vendor terms, or security evidence, with privacy counsel reviewing edge cases.

Evidence should show threshold calculations, privacy notice language, consumer request handling, GPC processing, sensitive-personal-information controls, service-provider/contractor terms, and risk/cyber/ADMT readiness where applicable.

  • Name one accountable owner and one reviewer for the Deadlines and Compliance Calendar workflow.
  • Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
  • Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
  • Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.
Sources for this answer
California Privacy Protection Agency FAQ
CPPA FAQ source for explaining which CPRA amendments added consumer rights and business obligations teams must track.
California legislative bill text
California Delete Act source for data-broker calendar items that should be tracked separately from core CPRA rights work.
Privacy Framework
NIST source used only as implementation evidence context; it does not supersede California statutory or CPPA deadlines.
Section 3

Which edge cases should teams check before relying on a Deadlines and Compliance Calendar decision?

Most CPRA mistakes happen at the boundary between CCPA and CPRA terminology, sale versus sharing, sensitive personal information, data-broker duties, and draft or phased regulatory requirements.

Review this section before launching a data flow, ad-tech integration, consumer interface, vendor contract, retention rule, risk assessment, or cyber audit control.

  • Check whether the rule changes for minors, consumers, business users, public-sector bodies, regulated sectors, high-risk services, or cross-border transfers.
  • Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
  • Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
  • Track unresolved assumptions in an open-questions section and route legal interpretation points for review.
Sources for this answer
California Consumer Privacy Act Regulations (March 2023)
CPPA regulations source for operative compliance duties, including timing and workflow requirements that belong on the CPRA calendar.
California Privacy Protection Agency FAQ
CPPA FAQ source for explaining which CPRA amendments added consumer rights and business obligations teams must track.
California legislative bill text
California Delete Act source for data-broker calendar items that should be tracked separately from core CPRA rights work.
Privacy Framework
NIST source used only as implementation evidence context; it does not supersede California statutory or CPPA deadlines.
Section 4

How should teams operationalize Deadlines and Compliance Calendar with proportionate controls?

Use a CPRA workflow that captures threshold status, data categories, consumer rights, opt-out signals, vendor role, retention logic, risk/cyber/ADMT trigger, owner, and review date.

The output should be a threshold memo, notice update, DSAR workflow, opt-out/GPC implementation record, vendor clause map, risk-assessment intake, or audit evidence pack.

  • Create a short intake question that identifies the Deadlines and Compliance Calendar scenario.
  • Map the answer to a required action, evidence field, owner, reviewer, and review date.
  • Check the specific CPRA deadline that applies, such as the 10-business-day receipt notice, the 45-day response window, the 15-business-day opt-out or limit-use window, or the recurring annual data broker dates.
  • Update the workflow when official source material changes or when internal evidence shows recurring exceptions.
Sources for this answer
California Consumer Privacy Act Regulations (March 2023)
CPPA regulations source for operative compliance duties, including timing and workflow requirements that belong on the CPRA calendar.
California Privacy Protection Agency FAQ
CPPA FAQ source for explaining which CPRA amendments added consumer rights and business obligations teams must track.
California legislative bill text
California Delete Act source for data-broker calendar items that should be tracked separately from core CPRA rights work.
Recommended next step

Turn US CPRA Deadlines and Compliance Calendar into assigned work

This US CPRA guide turns turn Deadlines and Compliance Calendar into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow
Open Assessment Autopilot for US CPRA

Turn Deadlines and Compliance Calendar into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CPRA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

California Consumer Privacy Act Regulations (March 2023)
cppa.ca.gov
Referenced sections
  • CPPA regulations source for operative compliance duties, including timing and workflow requirements that belong on the CPRA calendar.
"approved the California Privacy Protection Agency's regulations"
California legislative bill text
leginfo.legislature.ca.gov
Referenced sections
  • California Delete Act source for data-broker calendar items that should be tracked separately from core CPRA rights work.
"requires the Agency to establish an accessible deletion mechanism"
California Privacy Protection Agency FAQ
cppa.ca.gov
Referenced sections
  • CPPA FAQ source for explaining which CPRA amendments added consumer rights and business obligations teams must track.
"The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses"
CPPA proposed CCPA regulations
oag.ca.gov
Referenced sections
  • Supports Deadlines and Compliance Calendar under the US CPRA.
"(c) Illustrative examples follow: 1"
Privacy Framework
nist.gov
Referenced sections
  • NIST source used only as implementation evidence context; it does not supersede California statutory or CPPA deadlines.
"Organizations should not assume implementation of these Privacy Framework activities or outcomes means that they have met the"
Related guides

Explore more topics

California CPRA Checklist
Practical guidance for the California CPRA checklist, with practical decisions, evidence, edge cases, and external source citations.
California CPRA FAQ
Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations.
California CPRA penalties and fines Guide
US CPRA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations.
California CPRA Requirements Guide
Practical guidance for California CPRA requirements, with practical decisions, evidence, edge cases, and external source citations.
California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide
California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations.
California Data Broker Deletion Workflow Guide
California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations.
California Data Broker Registry and DROP Guide
California Delete Act guide to the Data Broker Registry and DROP, with practical decisions, evidence, edge cases, and official source citations.
California Delete Act data broker registry and DROP guide
California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources.
CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation
US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations.
CPRA Global Privacy Control (GPC): opt-out requirements and enforcement FAQ
US CPRA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Applicability Test Guide
Practical guidance for the US CPRA applicability test, with practical decisions, evidence, edge cases, and external source citations.
US CPRA CCPA vs CPRA Guide
US CPRA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Compliance Guide
Practical guidance for the US CPRA compliance, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Consumer Rights Workflow Guide
US CPRA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Contract Terms Guide
US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Contracts Contractors And Service Providers Guide
US CPRA guidance for Contracts Contractors And Service Providers, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Correction Rights Guide
US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Cppa Regulations Tracker Guide
US CPRA guidance for Cppa Regulations Tracker, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Cyber Audit Readiness Workflow Guide
US CPRA guidance for Cyber Audit Readiness Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA DSAR And Correction Workflow Guide
US CPRA guidance for DSAR And Correction Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA GPC Handling Guide
US CPRA guidance for GPC Handling, with practical decisions, evidence, edge cases, and external source citations.
US CPRA GPC Handling Workflow Guide
US CPRA guidance for GPC Handling Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Retention Guide
US CPRA guidance for Retention, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessment Intake Workflow Guide
US CPRA guidance for Risk Assessment Intake Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessment Template Guide
US CPRA guidance for CPRA Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessments And Cybersecurity Audits Guide
US CPRA guidance for Risk Assessments And Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sensitive Personal Information Guide
US CPRA guidance for Sensitive Personal Information, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sensitive Personal Information Limits Guide
US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sharing and Cross-Context Behavioral Advertising Guide
US CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations.
US CPRA vs Colorado Privacy Act Guide
US CPRA guidance for CPRA vs Colorado Privacy Act, with practical decisions, evidence, edge cases, and external source citations.
US CPRA vs Virginia Vcdpa Guide
US CPRA guidance for CPRA vs Virginia Vcdpa, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about ADMT under the US CPRA?
US CPRA guidance for ADMT, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Contract Terms under the US CPRA?
US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Correction Rights under the US CPRA?
US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Cybersecurity Audits under the US CPRA?
US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about retention under the California CPRA?
California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations.
What should teams do about Risk Assessments under the US CPRA?
US CPRA guidance for Risk Assessments, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Sensitive Personal Information Limits under the US CPRA?
US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Sharing and Cross-Context Behavioral Advertising under the California CPRA?
California CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations.