How to comply with CCPA?

To comply with the CCPA, a covered business must ensure that its actual data practices match the information and privacy choices provided to California consumers.

• Determine whether the CCPA applies: Check whether your business meets the law’s applicability criteria and which data processing activities fall within its scope.

• Map personal information: Record what personal and sensitive personal information you collect, where it comes from, why it is used, how long it is retained, who receives it, and whether it is sold or shared.

• Provide the required notices: Give consumers a Notice at Collection at or before collecting their information. It should explain what data is collected, why it is used, how long it is retained, and whether it is sold or shared. The privacy policy should also be reviewed and updated at least once every 12 months.

• Handle consumer requests: Provide clear methods for consumers to request access to, correction of or deletion of their personal information. Confirm receipt within 10 business days and generally respond within 45 calendar days.

• Provide opt-out options when required: Businesses that sell or share personal information must offer a clear way to opt out and honour recognised preference signals, such as Global Privacy Control.

• Offer the right to limit when required: If sensitive personal information is used or disclosed for purposes covered by the right to limit, consumers must be given a way to restrict those activities.

• Limit and protect personal information: Collect, use and retain only the information reasonably necessary for the stated purpose. Apply appropriate administrative, technical and physical security measures.

• Review third-party relationships: Use compliant contracts with service providers, contractors and third parties, and take reasonable steps to ensure they follow the agreed restrictions.

• Maintain internal procedures: Train employees who handle privacy requests, document how requests are processed and review compliance whenever business practices change.

CCPA compliance is an ongoing process. The exact requirements depend on how a business collects, uses, retains, sells, shares and discloses personal information.