CPRA Compliance Checklist: Ensuring Compliance in 2023

With the California Privacy Rights Act (CPRA) having gone into effect on January 1, 2023, it becomes imperative for applicable businesses to assess their standing with the law. An excellent way to do this is through a CPRA compliance checklist, which provides a roadmap to navigate the intricacies of the regulation.

The CPRA is a comprehensive state privacy legislation that amends and updates the California Consumer Privacy Act (CCPA). In short, the CPRA introduces new consumer rights for Californians, imposes strict obligations for businesses that collect their personal information, and establishes the California Privacy Protection Agency (CPPA) to oversee enforcement proceedings.

This article will provide a brief rundown of the CPRA's key provisions, its scope, the requirements of applicable businesses, and the enforcement actions for non-compliance. We'll then provide a comprehensive CPRA compliance checklist to help you understand your obligations and how to meet them accordingly. Let's dive in!

The Importance of the CPRA

The CPRA is a game-changer for the digital privacy landscape. It's not just another set of rules to follow; it's an opportunity for businesses to promote trust, strengthen consumer relationships, and demonstrate respect for consumers' privacy in several ways.

Firstly, the CPRA puts consumers back in control of their personal information by requiring businesses to be open and accountable. This works out great for businesses and consumers alike. After all, when people feel confident that their privacy is protected, they are more likely to engage with a business and share their information willingly.

In addition, the CPRA enhances personal information security by requiring businesses to implement robust safeguards against data breaches and unauthorized access. This decreases the danger of reputational harm and showcases a dedication to providing a secure environment for consumers' information.

Furthermore, the CPRA enables businesses to set themselves apart from competitors. By prioritizing privacy beyond mere compliance, businesses can gain a competitive edge, attract privacy-conscious consumers, and strengthen their reputation.

So, rather than viewing the CPRA as a burdensome responsibility, consider it an opportunity to build trust, enhance security, and gain a competitive advantage. By embracing the CPRA's principles, you can develop a privacy-driven business culture and foster strong customer relationships. CPRA compliance isn't just legally required—it's a smart business move that can provide immense value in the long run.

Who Does the CPRA Affect?

At first glance, the CPRA appears to apply primarily to businesses having offices in California. However, excluding certain charitable organizations and governmental bodies, the CPRA applies to businesses that collect personal information from Californians, regardless of their location.

More specifically, the CPRA applies to for-profit entities that do business in California or handle the personal information of California's residents and satisfies at least one of the following criteria:

As of January 1, 2023, have annual gross revenue over $25 million in the preceding calendar year
Annually buys, sells, or shares the personal information of 100,000 or more consumers or households
Derives at least 50% of annual revenue from selling or sharing consumers' personal information

It’s important to note that the CPRA also applies to entities that control or are controlled by a business that falls within the above categories, provided that they share common branding and/or joint control. This category of entities typically includes service providers, contractors, and other third-party vendors.

Requirements of the CPRA

The CPRA's requirements revolve around promoting transparency, enhancing consumer privacy rights, and ensuring that businesses are held accountable for ensuring the privacy and confidentiality of personal information.

We won’t dive deep into the CPRA’s requirements in this article, but for more in-depth coverage of the CPRA’s requirements, check out our article: CCPA/CPRA Requirements.

That said, here's a concise summary of the new requirements the CPRA levies on applicable businesses:

Expanded consumer rights: The CPRA grants consumers additional rights aside from their CCPA rights, including the right to limit the use of sensitive personal information, restrict the sharing of personal data, and correct incorrect personal information. Understanding these rights enables businesses to develop processes and systems that empower consumers to exercise control over their personal information.
Improved data protection obligations: The CPRA imposes more stringent data protection duties, requiring businesses to implement safeguards and risk assessments to protect personal information. By comprehending these obligations, businesses can strengthen their security practices through safeguards like encryption, access controls, and regular risk assessments to minimize potential threats and data breaches.
Greater transparency and disclosures: Businesses must provide detailed information about their data management practices, including the purpose for collecting personal data, the categories of data collected, and data sharing practices. In furtherance of this, businesses must provide clear and comprehensive disclosures through a CPRA privacy policy.
Introduction of a new personal information category: The CPRA introduces a new class of information known as "Sensitive Personal Information (SPI)." Examples include data such as precise geolocation, sexual orientation, health data, financial information, and biometric information, to mention a few. It's imperative that businesses understand SPI and its associated implications. In particular, businesses must ensure that SPI receives heightened protection and is collected only after obtaining explicit consumer consent.
Data retention requirements and accountability: The CPRA emphasizes accountability and requires businesses to implement data retention policies to ensure that information is not retained for longer than necessary. Understanding these requirements helps businesses establish adequate data management practices, including regularly assessing data retention policies and procedures.
Service provider and vendor management: The CPRA requires businesses to ensure their vendors and service providers comply with its provisions. In other words, businesses must set up processes to evaluate and monitor the privacy practices of their vendors. Practically speaking, this would entail conducting due diligence and integrating privacy requirements into contractual agreements.

CPRA Enforcement

The CPRA’s new enforcement agency, the CPPA, is primarily responsible for enforcing the law. However, California's Attorney General also retains civil enforcement authority.

In other words, CPRA enforcement takes the combined efforts of the Attorney General's office and the CPPA to address infractions and ultimately protect the privacy of Californians.

The CPPA and the Attorney General will be responsible for the following:

Investigate and enforce violations of the CPRA.
Conduct audits and inspections of businesses to assess compliance.
Respond to consumer complaints related to privacy rights.
Initiate legal actions against non-compliant businesses.
Release regulations to provide clarity on CPRA requirements.
Offer guidance and resources to businesses for achieving compliance.
Issue fines and penalties for violations of the CPRA.
Foster a culture of privacy and advocate for the protection of personal information.

Penalties For Non-Compliance with the CPRA

Non-compliance with the CPRA may lead to substantial fines that can add up quickly and significantly affect a business's bottom line. Below are the penalties for CPRA infringements:

Up to $7,500 for each intentional violation of the CPRA.
Up to $2,500 for each unintentional violation of the CPRA or failure to cure violations within the specified timeframe.
An additional fine of $7,500 for each violation involving the personal information of consumers under 16.
Statutory damages of at least $100 and up to $750 for each violation.

Beyond the monetary penalties, non-compliance with the CPRA can also harm a business's image and lead to a loss of consumers' trust. Finally, CPRA violations can result in potential legal action from affected consumers, thanks to the CPRA’s private right of action.

CPRA Compliance Checklist

In light of the CPRA's requirements for applicable businesses, we've compiled a practical CPRA compliance checklist below.

Keep in mind that this checklist is meant to serve as a starting point for CPRA compliance and should be tailored to your specific business operations and data processing practices.

Finally, ensure you regularly assess and adjust your compliance efforts to align with any new guidance or requirements issued by regulatory authorities.

Let's get started.

Create a personal information inventory and map your data flows

The first compliance step for any CPRA-covered business is to perform a personal information audit to map data flows within and outside the business. The results of this audit would then need to be compiled into an in-depth and regularly updated data inventory.

Be sure to keep comprehensive records of the purposes, categories, and sources of personal information as well as any third-party recipients.

Revise privacy policies and relevant disclosures

Under the CPRA, applicable businesses must publish a comprehensive breakdown of all aspects of their data processing operations.

Typically, you would provide this disclosure within your website privacy policy. However, certain relevant information could be hosted on a different webpage. For instance, most businesses choose to separate their cookie policy and “notice at collection” from their privacy policy.

In any case, your privacy policy must at least address the following details to conform with the CPRA’s disclosure requirements:

The categories of personal and sensitive information you collect and the sources
The purposes for each category of information collected
Consumer rights under the CPRA and how to exercise them
A declaration of whether you sell and/or share personal information
Your data retention policies
Your business’s contact information

Implement effective data security measures

Under the CPRA, businesses must implement effective industry-standard security measures to protect consumers' personal and sensitive information.

In short, this requirement can be broken down into a three-step process:

Implement technical and organizational measures (such as data encryption and intrusion detection systems) to protect personal information from data breaches and unauthorized access.
Regularly assess and update security protocols, including access controls and network security.
Develop a robust incident response plan to manage and mitigate security incidents and breaches effectively.

Observe CPRA consumer's rights

The CPRA provides consumers with several new rights in addition to their rights under the CCPA. This includes:

Right to correct personal information
Right to limit the use and disclosure of sensitive personal information
Right to access information about automated decision-making
Right to opt out of automated decision-making

Accordingly, businesses must establish procedures for helping consumers exercise these rights and responding to requests promptly.

Set up operational procedures and processes

The CPRA mandates that businesses incorporate consumer control and data protection into every facet of their operations. In furtherance of this objective, businesses must observe the following essential requirements:

If you sell or share personal information, provide a "Do Not Sell or Share My Personal Information" link that allows consumers to exercise their CPRA opt-out right.
Ensure your privacy policy includes a link to your CPRA Do Not Sell or Sharepage.
Provide a link that reads "Limit the Use of My Sensitive Personal Information," which enables consumers to restrict the use or disclosure of their sensitive information.
Update customer, employee, and service provider contracts to ensure they align with the CPRA’s provisions.

Train employees on CPRA compliance

It’s a best practice to ensure that your employees understand CPRA compliance fundamentals and the importance of data protection.

In short, you should:

Provide comprehensive privacy training to all employees, emphasizing their responsibilities and obligations.
Build a data privacy culture and create awareness for CPRA compliance.
Regularly communicate updates or changes in privacy policies, procedures, and trends in the data protection space.

Frequently Asked Questions about the CPRA

How has the CPRA changed California privacy law?

The CPRA was adopted by voters in the general election of November 2020, and the law went into full effect on January 1, 2023. The CPRA significantly amends and strengthens the CCPA's obligations, bringing California’s data protection standards closer to the GDPR in more ways than one.

Are there any specific provisions in the CPRA that businesses should pay attention to regarding data minimization?

Yes, the CPRA does emphasize the principle of data minimization. It requires businesses to limit the collection, use, retention, and sharing of personal information to what is necessary and proportionate to achieve the purposes for which it was collected or consented to.

How does the CPRA define Sensitive Personal Information (SPI), and what obligations does it impose on businesses?

Under the CPRA, SPI includes social security numbers, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, and more. Essentially, applicable businesses must give consumers the right to limit the use and disclosure of their sensitive personal information.

Does the CPRA introduce any changes to the requirements for service provider agreements?

The CPRA sets out new obligations when entering into service provider agreements. Essentially, businesses must now ensure that service providers comply with the CPRA and can only use personal information for the limited and specified purposes established in the agreement.

Are there any new requirements under the CPRA related to data retention and deletion?

Yes, the CPRA introduces new data retention obligations and updates the CPRA right to deletion. Businesses must establish retention periods for different categories of personal information and implement processes to securely delete personal information after the retention period expires or when it is no longer necessary for the purposes for which it was collected.

Conclusion

The CPRA modifies the CCPA, expands consumer rights, and specifies how businesses must operate when it comes to data privacy matters in California. Thanks to our CPRA compliance checklist, you now have a solid starting point to begin your CPRA compliance journey. And don't worry; we're with you every step of the way.

At Captain Compliance, our CPRA compliance solution and superheroes will help put you on the fast track to achieving compliance. Whether it's conducting thorough Data Processing Impact Assessments (DPIAs) or drafting CPRA-compliant policies, notices, and agreements, we have all the resources and insights you need to stay on top of developments in this area of law.

Ready to become CPRA-compliant and avoid legal exposure? Get in touch today!

Joel Lim