Work through what the California Consumer Privacy Act says about notice, consumer requests, sale and sharing, and sensitive personal information — and record what applies to your business.
CCPA/CPRA is now adoptable in ReadyGDPR. The catalogue carries 22 controls quoted verbatim from California Civil Code section 1798.100 et seq. as published by the California Legislative Information service. Each control shows the provision it comes from, links to the official text, and records your own determination of whether it applies to you. ReadyGDPR does not certify compliance and nothing here is legal advice.
The California Consumer Privacy Act (CCPA) is a comprehensive privacy law that came into effect on January 1, 2020. It gives California residents unprecedented control over their personal information held by businesses.
Updated by the California Privacy Rights Act (CPRA) in 2023, the CCPA establishes consumer rights to know, delete, correct, and opt-out of data sales. It applies to for-profit businesses that do business in California and meet certain thresholds.
Key difference from GDPR: CCPA focuses on "sale" and "sharing" of personal information, requires opt-out (not opt-in) for data sales, and has different territorial scope. Unlike India's DPDP Act which is consent-based, CCPA uses an opt-out model. Compare with Saudi Arabia's PDPL requirements.
The Act's thresholds are below. Whether your business meets any of them is a determination for you or your counsel.
Annual Gross Revenues
California businesses exceeding this threshold
Data Processing Volume
Buy, sell, or share personal information
Revenue from Data Sales
From selling or sharing personal information
Note: The business must also collect personal information from California residents and do business in California (physical presence not required).
Rights that California residents can exercise
Consumers can request what personal information you've collected about them in the last 12 months
Consumers can request deletion of their personal information (with exceptions)
Consumers can direct a business not to sell or share their personal information (Civil Code section 1798.120)
Businesses cannot discriminate against consumers who exercise their CCPA rights
Consumers can request correction of inaccurate personal information
Consumers can limit the use and disclosure of their sensitive personal information (Civil Code section 1798.121)
Essential components of a compliant CCPA program
Comprehensive notice at collection and privacy policy with CCPA disclosures
Clear 'Do Not Sell or Share My Personal Information' link on homepage
Two or more methods for submitting verified consumer requests
45-day response timeline (extendable to 90 days with notice)
Contracts with all service providers processing personal information
Annual metrics on consumer requests and data sales
Financial penalties for non-compliance
Up to $7,500 per violation
Willful or knowing violations of CCPA requirements
Up to $2,500 per violation
Non-intentional violations of CCPA requirements
Private Right of Action: Consumers can sue for $100-$750 per incident (or actual damages) for data breaches caused by failure to maintain reasonable security
Everything you need in one platform
Public portal with email verification for Know, Delete, Correct, and Opt-Out requests. Automated 45-day deadline tracking and response templates.
Ready-to-use "Do Not Sell or Share My Personal Information" link and landing page. Track opt-out preferences and integrate with your systems.
Auto-generate CCPA-compliant privacy policies with all required disclosures. Include notice at collection, categories of data, and consumer rights.
Track and report annual metrics on consumer requests. Generate compliance reports for Know, Delete, Opt-Out, and Correct requests.
They are one statute. The California Privacy Rights Act amended the CCPA rather than replacing it, so the operative text is still California Civil Code section 1798.100 et seq. The CPRA amendments added the right to correct, the right to limit the use of sensitive personal information, and the sharing concept alongside sale. The catalogue in ReadyGDPR quotes the amended text as it currently stands.
Section 1798.140 defines a business by reference to doing business in California and meeting one of the thresholds above, not by where the business is incorporated or hosted. Physical presence is not part of the definition. Whether a given company does business in California is a determination for that company or its counsel, and ReadyGDPR records the determination rather than making it.
The evidence carries over further than the controls do. A data inventory built for Article 30 feeds the notice at collection, and a request workflow built for Article 15 covers most of the right to know. What does not carry over is the sale and sharing machinery, the opt-out posture, and the 45-day clock, which runs differently from the GDPR month. The GDPR and CCPA comparison sets the two side by side.
An organisation in ReadyGDPR can hold more than one framework, so the GDPR and CCPA catalogues sit alongside each other and each control keeps its own citation. If you are still choosing between tools, our write-up on compliance software that manages both GDPR and CCPA walks through what to look for in data mapping, consent, and request handling.
Quick reference guide to understand key differences across regulations
Understand how different data protection laws compare and overlap
EU General Data Protection Regulation - 99 articles, strictest global standard
Key Focus: Learn about Article 30 ROPA & 72-hour breach notification
India Digital Personal Data Protection Act - Consent-based framework
Key Focus: Understand data fiduciary obligations & Data Protection Board
Saudi Arabia Personal Data Protection Law - SDAIA requirements
Key Focus: Navigate SDAIA registration & cross-border transfers
Start with our free plan.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.
ReadyGDPR is a guided compliance tool, not a certifying authority, and is not a law firm. The regulatory text quoted here is provided for reference; whether it applies to your organisation is your determination. Nothing here is legal advice.