The California Consumer Privacy Act (CCPA) and its 2023 amendment, the California Privacy Rights Act (CPRA), give California residents sweeping rights over their personal information — and place significant operational obligations on the organizations that collect it. Meeting these obligations isn’t a legal exercise you complete once and move on from. It’s an ongoing operational function that requires your security program to work as hard as your legal team.
Most organizations approach CCPA/CPRA as a compliance project — draft a privacy notice, update the website, add a “Do Not Sell” link. That’s the beginning, not the end. The organizations that actually protect themselves from enforcement, litigation, and reputational damage are the ones that have operationalized privacy — embedding it into how they collect data, how they protect it, and how they respond when something goes wrong.
CCPA and CPRA: What Actually Changed
The CCPA went into effect in January 2020, giving California residents the right to know what personal information is collected about them, the right to delete that information, and the right to opt out of the sale of their data.
The CPRA — which took effect January 1, 2023 — significantly expanded these obligations. It created a new category of sensitive personal information with heightened protections, established the California Privacy Protection Agency (CPPA) as a dedicated enforcement body, added the right to correct inaccurate personal information, and introduced new requirements around data minimization and retention.
For organizations, the practical impact is significant. You must now limit the collection of personal data to what is necessary for disclosed purposes. You must retain data only as long as necessary. You must honor consumer requests not just to opt out of sale, but to limit the use of their sensitive personal information. And you must document your data practices in ways that can withstand CPPA audit scrutiny.
Who Needs to Comply
CCPA/CPRA applies to for-profit businesses that collect personal information from California residents and meet at least one of these thresholds: annual gross revenue over $25 million, buying or selling personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.
Nonprofits are generally exempt from CCPA/CPRA as written, but this doesn’t mean privacy obligations don’t apply. Nonprofits that operate programs funded by government agencies, healthcare organizations, or enterprise partners increasingly face contractual privacy requirements that mirror CCPA standards. And if a nonprofit has a for-profit subsidiary or affiliate, CCPA may apply through that relationship.
For covered organizations, enforcement is real. The CPPA can impose civil penalties of up to $2,500 per unintentional violation and $7,500 per intentional violation. With millions of California residents as potential data subjects, the exposure adds up quickly.
The Gap Between Having a Privacy Policy and Being Operationally Compliant
Most organizations have updated their privacy policies and added the required disclosures. That satisfies the visibility requirements. It does not satisfy the operational requirements.
Here’s where the gap typically lives.
Data mapping isn’t done or isn’t maintained. CCPA/CPRA compliance requires knowing exactly what personal information you collect, where it comes from, how it’s used, who it’s shared with, and how long you keep it. Without a current data map, you can’t respond accurately to consumer requests, demonstrate data minimization, or defend your practices to a regulator.
Consumer request workflows don’t exist. When a California resident submits a request to know, delete, or correct their information, you have 45 days to respond. If there’s no defined workflow — who receives the request, how data is located across systems, who approves the response, how it’s documented — you’ll either miss the deadline or respond incorrectly. Both create liability.
Vendor contracts haven’t been updated. CPRA requires specific contract language with service providers, contractors, and third parties that handle personal information. Every vendor processing California resident data on your behalf needs an updated data processing agreement that limits how they can use that data. Most organizations haven’t updated these contracts.
Sensitive personal information isn’t treated differently. CPRA created a new category: sensitive personal information, including Social Security numbers, financial account details, health information, precise geolocation, and biometric data. Consumers now have the right to limit the use and disclosure of their sensitive PI. If your systems don’t distinguish between regular and sensitive PI, you can’t honor this right.
There’s no privacy incident response procedure. California law requires notification to the CPPA and affected individuals when a breach of certain categories of personal information occurs. If your incident response plan doesn’t address privacy breaches specifically — including the notification timeline and content requirements — you’re exposed.
How to Operationalize CCPA/CPRA in Four Steps
Step 1: Establish the benchmark. Start by mapping your data landscape. Identify every system, application, and process that collects, stores, processes, or shares California resident personal information. Document the categories of PI collected, the business purpose for each, who it’s shared with, and retention timelines. This data map is your defensible baseline — and the foundation for every other compliance activity. For organizations that have never done this, a privacy risk assessment alongside the data mapping exercise identifies where the highest exposures are.
Step 2: Measure against the benchmark. Assess your current practices against CCPA/CPRA requirements. Where are your consumer request workflows? Are your vendor contracts updated? Do your privacy notices accurately reflect what you actually do? Is the sensitive PI identified and protected at the data layer? This gap analysis produces a prioritized list of what needs to be fixed, in what order, within what timeline. Technical findings and governance findings should both be surfaced — they require different remediation owners.
Step 3: Enable informed decisions. The gap analysis results need to be translated into clear business decisions. Some gaps require technical remediation — updating data classification in your systems, implementing consent management tools, and building request intake workflows. Others require policy development — updating your retention schedule, revising vendor contract templates, and building a privacy incident response playbook. Leadership needs to understand the tradeoffs between cost, timeline, and risk so decisions about sequencing and investment are grounded in reality.
Step 4: Support execution and ongoing governance. Operationalizing privacy means the program doesn’t stop after the initial buildout. CPRA requires annual data mapping reviews for high-risk processing activities. Consumer request workflows need to be tested and updated as systems change. Vendor agreements need to be reviewed as new processors are added. Training needs to keep employees current on what sensitive PI they handle and how. The program needs an owner — a Privacy Officer or vCISO with privacy responsibility — who drives the ongoing governance cycle.
Where Security and Privacy Intersect
CCPA/CPRA creates direct security obligations that your security program must satisfy.
The CCPA’s private right of action applies specifically to certain data breaches — if nonencrypted and nonredacted personal information is subject to unauthorized access due to a business’s failure to implement reasonable security practices, affected consumers can sue. This makes your security posture a direct input to your privacy liability.
Reasonable security under California law is defined by reference to the Center for Internet Security (CIS) Controls and NIST frameworks. Organizations that have implemented documented, tested security controls are in a fundamentally better position to defend against CCPA breach litigation than those without a formal security program.
This is why privacy and security must operate under the same roof. A security program that includes access controls, encryption, vulnerability management, and incident response directly satisfies the CCPA’s reasonable security requirement. A risk management program identifies where personal information is at highest risk. Incident response planning ensures breach notification timelines can be met. Security awareness training keeps employees from handling personal information correctly.
When privacy compliance is treated as a legal project separate from the security program, gaps form at the intersection. When privacy and security are managed together, the controls that protect data serve both purposes simultaneously — more efficiently and more effectively. For a broader view of how CCPA fits within your overall compliance obligations, see our Complete Cybersecurity Compliance Checklist.
How CISOSHARE Supports CCPA/CPRA Compliance
CISOSHARE’s data privacy services bring privacy and security together under one engagement. Their four-step operating loop — establish the benchmark, measure against it, enable informed decisions, and support execution — maps directly to the operationalization process above.
Their CCPA/CPRA support includes business review and privacy scope definition, data mapping and system inventory, privacy risk assessment and gap analysis against California requirements, privacy program design including policy development, governance structure, and response planning, vendor contract review, and consumer rights workflow development.
Where CISOSHARE is different is the execution layer. They support rollout, remediation, and ongoing governance so the program doesn’t stall at the recommendation stage. Their Privacy Officer as a Service option brings in CISOSHARE leadership for ongoing privacy and security guidance — maintaining the governance cycle rather than handing off a document and walking away.
Because privacy and security live under one roof at CISOSHARE, the same team that frames the privacy program also supports the operational security work needed to sustain it — closing the gap that most organizations struggle with when privacy and security are managed separately.
FAQ
Does CCPA/CPRA apply to my organization if we’re not based in California?
Yes, if you collect personal information from California residents and meet the applicability thresholds, CCPA/CPRA applies regardless of where your organization is headquartered.
What’s the difference between CCPA and CPRA?
CCPA (2020) established the original California privacy rights framework. CPRA (2023) amended and expanded it — creating the CPPA enforcement agency, adding the right to correct and limit sensitive PI, and strengthening data minimization requirements. If you were compliant with the original CCPA, your program still needs updating to address CPRA additions.
How long do we have to respond to consumer requests?
45 calendar days from receiving a verifiable consumer request, with a one-time 45-day extension permitted when reasonably necessary. Clock starts when you receive the request, so having a defined intake and response workflow in place before requests arrive is essential.
