ccpa-checklistlisted

# CCPA / CPRA Checklist ## Applicability Thresholds CCPA/CPRA applies to for-profit businesses that collect California residents' personal information AND meet **at least one** of: | Threshold | Value | |-----------|-------| | Annual gross revenue | > $25 million | | Personal records bought/sold/shared annually | ≥ 100,000 consumers or households | | Revenue from selling/sharing personal info | ≥ 50% of annual revenue | CPRA (effective Jan 1, 2023) raises the data threshold to 100,000 (was 50,000 under original CCPA). ## Consumer Rights | Right | What it means | Response deadline | |-------|--------------|-------------------| | Right to Know | What categories/pieces of PI collected, sources, purposes, third parties | 45 days (+ 45 extension) | | Right to Delete | Request deletion of their PI (with exceptions) | 45 days (+ 45 extension) | | Right to Correct (CPRA) | Correct inaccurate PI | 45 days (+ 45 extension) | | Right to Opt-Out | Stop sale or sharing of their PI | Honored within 15 business days | | Right to Limit (CPRA) | Limit use/disclosure of sensitive PI | Honored within 15 business days | | Right to Non-Discrimination | No penalty for exercising rights | Ongoing | | Right to Data Portability | Receive their data in portable format | 45 days (+ 45 extension) | ## Privacy Notice Requirements Must disclose at or before collection: - [ ] Categories of personal information collected - [ ] Purposes for which each category is used - [ ] Whether PI is sold or sha