A CCPA Compliance Checklist for Third-Party Risk Management

Originally passed into law in June 2018 and in effect since January 2020, the California Consumer Privacy Act (CCPA) regulates business’ collection and sale of consumer data, aiming to protect California residents’ sensitive personal information and providing consumers with control over how that information is used.

In January 2023, the CCPA will be updated through the California Privacy Rights Act (CPRA) and apply to personal information collected by a covered business on or after January 1, 2022. While largely identical to the CCPA, the CPRA:

• Adds content to align it more closely with the EU’s General Data Protection Regulation (GDPR)
• Increases penalties for violations
• Authorizes the creation of the California Privacy Protection Agency, which will likely lead to increased enforcement

This post examines key requirements in CCPA, who it applies to, and how organizations can ensure their third parties are protecting their customer data. For simplicity, this post refers to both regulations – CCPA and CPRA – as the CCPA.

How Does the CCPA Define Personal Information?

Let’s start with how “personal information” is defined. The CCPA defines sensitive personal information as, “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

What Does the CCPA Require Companies (and Their Third Parties) to Do?

The CCPA requires companies to inform California residents about data being collected prior to collecting the data. It allows consumers to access all personal data held by a company and receive information about individuals or organizations with whom that data has been shared. It also allows consumers to opt out and prevent their personal data from being sold or shared with a third party.

Who Does the CCPA Apply To?

While the CCPA is technically California state law, its reach is felt far beyond the borders of the Golden State. CCPA oversight is not limited to businesses headquartered in California, or even to businesses physically operating in California—the CCPA applies to consumer data collected from any resident of California.

Given the fact that California is home to about 40 million people and would be the 5th largest economy in the world if it were its own country, the odds are good that if your business is collecting consumer data, you have collected the data of a California resident. In fact, many businesses opt to treat every consumer as if they were a California resident, and therefore prepare for CCPA compliance across their businesses.