CCPA / CPRA

The CCPA, amended by the CPRA, is California’s consumer privacy law. It applies to for-profit businesses that meet its revenue or data-volume thresholds and handle the personal information of California residents. Since the CPRA changes took effect, that information includes data collected from employees and from business contacts, not only from consumers.

The law gives residents the right to know what personal information is collected about them, to have it deleted or corrected, and to opt out of its sale or sharing. A business has to publish a notice at the point of collection, honour opt-out signals such as Global Privacy Control, and answer a verified request within 45 days, with one documented extension available.

Service providers and contractors work under contract terms that limit what they may do with the personal information they receive. The evidence for CCPA work is a paper trail of small, dated documents: the notices in force, the request log, opt-out records, and signed contract addenda. Each one has to be current, because the regulations under the law change more often than the statute itself.