🇺🇸 CCPA / CPRA Compliance

Methodology

1. 01

   Data Inventory

   Map all personal information collected, sold, or disclosed — including categories, sources, business purposes, and third-party recipients.

2. 02

   Rights Workflow Design

   Build consumer request workflows for access, deletion, portability, and opt-out of sale or sharing — with identity verification and response timeline controls.

3. 03

   Privacy Notice Review

   Update privacy notices to include CCPA-mandated disclosures, sensitive personal information categories, and 'Do Not Sell or Share My Personal Information' links.

4. 04

   Opt-Out Mechanism

   Implement GPC (Global Privacy Control) signal detection and opt-out mechanisms aligned to CPRA requirements — including technical implementation guidance for engineering teams.

5. 05

   Compliance Assessment

   Conduct a final assessment against CCPA/CPRA requirements and produce an audit-ready evidence package for regulatory review.

What You Get

• ✓ Personal information data inventory
• ✓ Consumer rights request workflows and templates
• ✓ Updated privacy notice with CCPA/CPRA disclosures
• ✓ Opt-out mechanism implementation guide (GPC signal)
• ✓ CCPA/CPRA compliance assessment report

Frequently Asked

Does CCPA apply to Indian companies?

Yes, if you have California-resident customers or employees. CCPA/CPRA applies to for-profit businesses that meet any of: $25M+ annual gross revenue, process data of 100,000+ California consumers/households annually, or derive 50%+ of revenue from selling/sharing personal information.

What is the difference between CCPA and CPRA?

CPRA (California Privacy Rights Act) amended and significantly expanded CCPA in 2023. It added new rights (correction, limiting use of sensitive information), created the California Privacy Protection Agency, and introduced stricter requirements for contractors and service providers — especially around data retention and security audits.

What is the Global Privacy Control (GPC) signal?

GPC is a browser-level signal indicating the user has opted out of the sale or sharing of their personal information. CPRA requires businesses to honour GPC signals where technically feasible. We can advise on both the technical implementation and the legal obligations around GPC compliance.