What should teams do about retention under the California CPRA?
Teams should treat retention under the California CPRA as a data-minimization decision: identify the personal-information category, the disclosed purpose, whether retention remains reasonably necessary and proportionate, and the point when deletion or de-identification should occur.
The safest first step is to connect each retention period or retention criterion to a privacy-policy disclosure, system owner, legal hold or operational need, and dated review trigger.
- Write the retention decision by data category and purpose, not as one generic company-wide period.
- Attach the official source URL, short quote, privacy-policy text, and system owner to the evidence record.
- Route unclear retention exceptions, legal holds, or secondary uses to privacy counsel before launch.
Binding CCPA/CPRA data-minimization rule limiting retention to what is reasonably necessary and proportionate.
CPPA regulations page for current CCPA regulations implementing CPRA amendments and privacy-practice disclosures.
CPPA FAQ explains the practical rule that collection, use, and retention must be limited to expected, compatible, or consented purposes.