CCPA and CPRA Consumer Privacy Compliance

Flow chart of the CCPA engagement, 6 phases in order, each one selectable. Phase 1, Applicability and Data Mapping. We confirm whether the CCPA applies to you and map the personal information you collect and share. Activities: Test revenue and data volume thresholds; Inventory personal information categories collected; Map sale and sharing flows to third parties; Flag sensitive personal information handling. Hands over Applicability Assessment and Personal Information Data Map. Phase 2, Gap Assessment. We check your notices, opt-out mechanisms, and processes against the CCPA and CPRA amendments. Activities: Review privacy notices against CPRA requirements; Test the opt-out links and request channels; Check request handling against the 45-day deadline; Rank gaps by enforcement exposure. Hands over CCPA Gap Assessment Report. Phase 3, Rights and Opt-Out Design. We build the consumer request workflow and the opt-out signals, including Global Privacy Control handling. Activities: Build workflows for know, delete, and correct requests; Implement the do not sell or share link; Configure Global Privacy Control signal handling; Set up identity verification for requests. Hands over Consumer Rights Request Workflow. Phase 4, Notice and Disclosure Updates. We help you write privacy notices and disclosures at collection that match what you actually do. Activities: Rewrite the privacy policy per CPRA content rules; Draft notices at collection for each channel; Disclose categories collected, sold, and shared; Align retention statements with actual practice. Hands over Updated Privacy Notices and Disclosures. Phase 5, Vendor and Contract Review. We review service provider and contractor agreements so data sharing stays inside the law. Activities: Classify vendors as service providers, contractors, or third parties; Review contracts for required CCPA clauses; Remediate agreements that permit unrestricted use; Document the sharing relationships for disclosures. Hands over Vendor Classification and Contract Remediation List. Phase 6, Readiness Review. We run a final check so you can respond to a consumer or the regulator with confidence. Activities: Test the rights workflow with sample requests; Verify Global Privacy Control handling in production; Check notices against live data practices; Compile the compliance evidence pack. Hands over CCPA Readiness Report. Each phase begins from the artefact the phase before it produced.