Securiti Named a 2022 Cool Vendor in Data Security by Gartner

Download Now
Free Trial Schedule a Demo

Blogs

The Ultimate CCPA Compliance Requirements Checklist

Published on May 24, 2021 AUTHOR - PRIVACY RESEARCH TEAM

The California Consumer Privacy Act (CCPA) is well into effect and many organizations are fully compliant yet with the law. We have put together a checklist that organizations can use to see if they are currently compliant with the law.

The CCPA applies to organizations serving Californians, and that:

  1. Have annual gross revenues in excess of $25 million
  2. Handle the personal information of at least 50,000 consumers or devices
  3. Derive 50 percent or more in annual revenue from selling consumers’ personal information

Organizations that meet the criteria are required to comply with CCPA and will be held accountable in the case of non-compliance.

The CCPA Compliance Checklist

It is advisable to go through each item on this checklist to ensure your organization is compliant with the CCPA.

Update Privacy Policies
 Although companies follow the strictest standards when drafting privacy policies, they need to make sure that their policies are compliant with the CCPA.
Create Methods of Accessibility
 Establish a means for the customer to easily request data access and data deletion. This could be at minimum a toll-free number
Verification System
 People that can verify their identification can access their information held by organizations. Verification systems will be a part of the CCPA compliance regulations
Data Governance
 Prepare records, data maps and inventories of Californian’s personal data to fulfill any requests in an efficient and timely manner
Opt-Out Button
 Adding in an opt-out button will help you stay compliant without the added hassle of manually updating that customer.
Obtain Consent from Minors
 Minors under the age of 16 will not automatically consent under CCPA. Organizations need to develop a process by which they can obtain direct consent from those aged 13-16 years, or parents consent from minors under 13 years.

 

Disclosures

Under the CCPA's right to be informed, organizations will need to disclose personal information they collect with their owners. This disclosure is in two stages with different requirements for each.

Notice Before the Point of Collection

  • The business cannot collect personal information (PI) before the consent notice is shown
  • The consent notice should state the categories of PI collected and the purpose for which the PI is being collected
  • The notice should also include a link titled ‘Do not sell my Personal Information’ if the business sells personal information
  • The notice should also include a link or direction to the Privacy Notice/Policy of the Business
  • If more categories of PI are collected OR the purpose for which PI is being used changes then an updated consent notice has to be shown

Privacy Notice/ Policy

  • Categories of PI collected along with purpose and categories of sources
  • Categories of PI sold/shared/disclosed (or if not) along with categories of third parties shared with and purpose
  • Description of rights under CCPA along with process to exercise them and how verification of the request will be done (including a button titled ‘Do not sell my Personal Information)
  • Contact information of business along with last date of update of notice
  • If business knows it sells PI of consumers below 16 years of age then process for opt-in and opt-out of sale of minor's PI
  • Financial incentive policy if offered along with details of how a consumer's PI is evaluated and how consumers can opt-in and opt-out
  • For businesses handling 10,000,000 consumers PI in a year (June to June), DSR metrics (requests received, accepted, rejected and median no. of days to respond)

Selling Personal Information

Keeping the consumer informed is not the only thing organizations need to be aware of under the CCPA. Organizations need to make sure that the information they sell is according to the requirements of the CCPA. These requirements include:

    • Operationalizing 'Do not sell' i.e Ensuring consumers who have opted out, their PI is not sold/shared by the business within 15 days of receiving the request
    • Signing and enforcing agreements with service providers as per CCPA requirements before sharing PI
    • Provide individuals aged 16 or more with the ability to opt-out of the sale of their Personal information at any point
    • Detecting and accepting global opt-out preference signals/browser settings etc. for online businesses
    • Third parties who have bought the PI from the business will have to provide notice to consumers before using their sold PI for any other purpose than for which it was initially collected
    • Stop selling PI of individuals aged 16 or younger without their consent
    • Businesses must limit the subsequent sale of Personal Information by a service provider on behalf of the business if a consumer opts out of the sale of their PI
    • Honor opt-out request for at least 12 months before attempting to re-obtain consent to sell personal information again

The Right to Access

CCPA gives consumers the right to request access to any information held by organizations on the individual. Consequently, organizations are required to ensure  the following solutions are available to their customers:

  • Provide 2 options for consumers to request their personal information – an 800 number and another method, such as a web page
  • Verify  consumer’s request for example via a secure email
  • Provide all the required personal information within 45 days
  • If personal information was sold, organizations must also identify and inform the consumer the sources of information, its collection purpose, and the categories of third parties the data was sold to

As per the CCPA, the following information must be provided in an access request:

  • The categories of personal information the business has collected about the consumer in the preceding 12 months. and for each category identified, the categories of third parties to whom it disclosed that particular category of personal information
  • The categories of sources from which the personal information was collected
  • The business or commercial purpose for which it collected or sold the personal information
  • The categories of third parties with whom the business shares consumers’ personal Information with

The right to access is one of the toughest articles for businesses to comply with because organizations need to track the location of every consumer’s personal information in all on-premises and multi-cloud data systems. To meet this requirement, businesses need to identify personal and sensitive data solutions to help them ensure compliance with the CCPA.

The Right to Deletion

CCPA not only gives individuals the right to access their information but also the right to request the complete deletion of their data. The CCPA also allows consumers to request the deletion of their data. If an organization receives a valid, verified request from a consumer, it must ensure the consumer’s data is deleted. To fulfill this request, organizations need to do the following:

  • Collect information from the consumer for the request. Information can easily be collected through a form or portal on the organization’s website.
  • Use the collected information to verify the consumer’s request.
  • Determine if any exceptions permit the organization to retain the records.
  • Permanently and completely erasing the personal information on its existing systems with the exception of archived or back-up systems
  • Direct service providers to delete their records of the requesting consumers’ PI as well.

A consumer can send in a request to the business to delete their personal information and covered businesses would have to comply if the PI  is not required for:

  1. Transactional reasons
  2. Security reasons
  3. Identifying and fixing errors
  4. Free Speech considerations
  5. CalECPA Compliance
  6. Research for Public Interest reasons
  7. Expected Internal Use
  8. Legal Compliance
  9. Other Internal Uses

Cybersecurity

The CCPA grants aggrieved consumers the right to bring private lawsuits against an organization that has had a data breach, due to lax security measures, in which their personal data was compromised. The damages granted in lawsuits can start from $100 and go up to $750 per individual.

Organizations are therefore required to implement a robust cybersecurity framework to protect themselves from litigation. In case of a data breach where the organization does not have reasonable procedures in effect to maintain the confidentiality of their consumers’ personal information, they will be facing the prospect of damages that could easily reach over $1 million if more than 10,000 people are impacted.

The law does not specifically mention the procedures which are deemed reasonable.

In 2016 the AG of California released a report on Data Breaches and defined reasonable security measures to mean the implementation of 20 controls listed in the Center for Internet Security’s (CIS) Critical Security Controls, to identify the minimum level of information security that all organizations that collect or maintain personal information should meet and that an organization’s failure to implement all of the controls constitutes a lack of reasonable security.

The 20 controls are:

  1. Inventory of authorized and unauthorized devices.
  2. Inventory of authorized and unauthorized software.
  3. Security configurations for hardware and software on mobile devices, laptops, workstations, and servers.
  4. Continuous vulnerability assessment and remediation.
  5. Controlled use of administrative privileges.
  6. Maintenance, monitoring, and analysis of audit logs.
  7. Email and web browsing protection.
  8. Malware defense.
  9. Limitation and control of network ports, protocols, and services.
  10. Data recovery capability.
  11. Secure configurations for network devices such as firewalls, routers, and switches.
  12. Boundary defense.
  13. Data protection.
  14. Controlled access based on the need to know.
  15. Wireless account control.
  16. Account monitoring and control.
  17. Security skills assessment and appropriate training to fill gaps.
  18. Application software security.
  19. Incident response and management.
  20. Penetration tests and red team exercises.

Privacy Training

The CCPA requires that compliance professionals who handle consumer inquiries be trained on all the rights granted to consumers (this can be done through the help of online courses and training modules to give your staff a better understanding of the data privacy sector and how to manage consumers) under the CCPA, and how consumers can exercise those rights. This would include, for example, the employees staffing, the 800 number, and the ones who are responding to consumer inquiries and requests for information.

Key Takeaway

  • Companies have to comply with CCPA regulations and fulfill all customer personal data requests.
  • Failure to do so can result in hefty fines, lawsuits, and reputational damage.

Organizations that hope to comply with the CCPA using traditional methods will face several resource and time challenges. Automation is the only way to practically manage these requests. Securiti helps organizations automate their privacy management operations using artificial intelligence and robotic automation. Request a demo and start your CCPA compliance process today.

Bedrock of your Privacy & Security

A Comprehensive Platform

Request Demo

Share this

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Related Content

View More

June 28, 2022

DSARs: What You Need to Know

A data subject access request (DSAR) is a formal request by a user (data subject) to an organization collecting their data asking for details related to how their data is being collected, used, stored, and possibly shared. Furthermore,...

View More

June 21, 2022

The Ultimate Guide to Privacy Impact Assessments for CPRA

When the California Privacy Rights Act (CPRA) comes into effect, replacing the existing California Consumer Privacy Act (CCPA), organizations will have to change their current business practices around personal information handling. One significant change will be Regular Risk...

View More

June 20, 2022

What is RoPA? Records of Processing Activities Explained

Privacy laws and regulations are enacted to bring transparency and accountability to an organization’s behavior when it comes to collecting and processing users’ personal data. Before the introduction of the GDPR article 30, accountability and transparency associated with...

Products

Solutions

Systems

Newsletter

Users love Securiti on G2 G2 leader spring 2022 G2 leader summer 2022 G2 leader easiest business 2022 ISO certification RSAC Leader Forrester Badge IAPP Innovation award 2020 Sinet Innovator Award Gartner Cool Vendor Award

Company

Resources

Terms

Get in touch

[email protected]
PO Box 13039,
Coyote CA 95013

Copyright © 2022 Securiti

Sitemap - XML Sitemap

Securiti PrivacyOps Named a Leader in The Forrester WaveTM

View