US CPRA DSAR and Correction Workflow

Confirm that the legal entity is a CCPA business and classify the request before searching systems. A business operating only online with a direct relationship to the consumer may provide an email request method. Other businesses must provide at least two methods, including a toll-free number and, when they maintain a website, a website method. A misdirected or technically deficient request must be treated as properly submitted or the consumer must receive instructions to fix it.

Match the verification strength to the right, data sensitivity, and harm from unauthorized action. For a non-accountholder, a categories request may use two reliable matching data points; a specific-pieces request may use three reliable matches plus a signed declaration. Deletion and correction require a reasonable or reasonably high degree of certainty based on risk. Try to verify a correction request with information other than the contested field.

A request to know covers the preceding 12 months by default. The consumer may ask for information collected on or after January 1, 2022 beyond that period unless production is impossible or would involve disproportionate effort. Do not disclose Social Security, government identification, financial or medical account, password, security-answer, or unique biometric values; describe the type with enough particularity instead.

For deletion, erase, deidentify, or aggregate covered information in active systems; notify service providers and contractors; and notify third parties that received a sale or sharing unless that is impossible or disproportionate. Archived or backup data may wait until restoration or next access. Delete non-exempt data, restrict any retained exempt data to the exception's purpose, and give a detailed partial or full denial.

For correction, decide whether the contested information is more likely than not accurate from the totality of the circumstances, including its nature, source, supporting records, consumer documentation, purpose, and consumer impact. Correct active systems and instruct service providers and contractors. Deletion may substitute only when it does not harm the consumer or the consumer consents.

The privacy-operations owner should maintain the case record. Separate intake, verification, search, legal review, system action, recipient action, response, and closure so a reviewer can see where a request stalled and reproduce any denial.

Review missed deadlines, verification failures, repeated correction disputes, incomplete downstream responses, and inconsistent exceptions. Re-test after identity, account, data-store, retention, or vendor changes, and sample closed cases to confirm that the response matches recorded system actions.