US CPRA Retention

Civil Code section 1798.100 requires a category-level disclosure. A single statement such as "we keep information as long as necessary" does not identify a period and may not give a consumer meaningful criteria for determining one. Criteria should tell the reader what event starts or ends retention and what obligation can extend it.

Personal information includes information that identifies, relates to, describes, or could reasonably be linked with a consumer or household, not only direct identifiers. A category can have more than one purpose and therefore more than one justified period. For example, contact details used to deliver an order may also appear in a transaction record kept for a separately identified accounting or dispute purpose. Map the category, purpose, system, start event, normal end event, and supported extension instead of assigning one unexplained period to the whole database.

Start with the specific purpose disclosed when the information was collected. Identify the minimum information and time needed to achieve that purpose, the possible negative effects on consumers, and safeguards that address those effects. Storage cost, possible future usefulness, or the absence of deletion tooling does not establish that retention is reasonably necessary and proportionate.

Then test each proposed extension separately. A statute, court order, contract, active dispute, fraud investigation, or legal hold may support longer retention for particular records, but the facts and applicable rule determine its scope. Record the authority, affected categories, start and end conditions, and permitted use during the extension. Do not let a narrow exception pause deletion for unrelated copies or uses.

Privacy or data governance should maintain the retention schedule and notice mapping. The team responsible for each system should implement the end-of-period action. Legal should approve claimed legal obligations and holds, procurement should carry the schedule into service-provider and contractor controls, and security or internal audit should test whether deletion and deidentification run as designed.

The evidence record should connect the public disclosure to actual data. For each category and purpose, retain the approved period or criteria, governing authority, systems and vendors, clock-start event, deletion or deidentification action, exception logic, owner, approval date, and last test result.

The Notice at Collection must be available at or before collection and must include the retention period or criteria for every listed category. An online notice may link directly to the specific privacy-policy section containing the required information; sending the consumer to the start of a long policy does not meet the regulation's direct-link standard.

Before publication, compare the words with system rules. Criteria should be understandable without internal knowledge, and any broad phrase should be followed by the event or obligation that determines the endpoint. If a purpose, category, or period materially changes, assess whether the business must update the notice before collecting or using information under the new practice.