Handle SPI with the level of design and evidence the California rules now expect.
Grounded in the California statute, CPPA regulations, and the 2026 California rule changes.
Structured answer sets in this page tree.
Cited legal and guidance references.
SPI is one of the clearest examples of how the California regime moved beyond a generic disclosure law. Businesses now need a working model for classification, permitted use analysis, notices, and limitation workflows.
The first step is to identify where California sensitive personal information appears in systems, profiles, logs, and vendor disclosures. That classification should be tied to the actual purpose for which the data is collected or used.
If the business uses or discloses SPI only for the permitted purposes in the regulations, the right to limit may not apply in the same way. If the business goes beyond those permitted purposes, it should provide the notice of right to limit and implement the workflow.
SPI should appear in request metrics, contract reviews, and risk assessment decisions. It is one of the strongest signals that the business should be testing whether collection, use, and sharing remain reasonably necessary and proportionate.
Research Copilot can take California CPRA Sensitive Personal Information from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on California CPRA can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from California CPRA Sensitive Personal Information and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for California CPRA Sensitive Personal Information.