Your CCPA guide to data privacy compliance

‍

Data privacy has become an increasingly crucial concern for organizations and individuals alike. In addition to cyber attacks and identity theft, data is being leveraged as a way to target users for political and commercial messages. 

‍

To protect residents and secure data privacy, California has implemented sweeping legislation that will affect many organizations who wish to do business in the state. Here’s what you’ll need to know about California’s new regulations. 

‍

‍

What Is CCPA?

‍

CCPA is the California Consumer Privacy Act. This law, passed by the California state legislature, sets requirements for how businesses need to handle the personal data of California residents. It also gives specific rights to California residents regarding their personal data, and businesses are required to respect and grant those rights. The CCPA took effect in January of 2020, and it is the first law of its kind in the U.S., however; it shares many elements and frameworks with the UK’s General Data Protection Regulation (GDPR).

‍

Who needs to comply with CCPA?

‍

A core difference between CCPA and GDPR is that the CCPA applies to more specific organizations with narrower criteria.

‍

The CCPA applies to all for-profit businesses that sell the data of California residents beyond a certain threshold. For-profit businesses located anywhere in the world must follow the CCPA if they meet at least one of these criteria:

  • You sell the personal information of over 50,000 California residents per year
  • You have an annual gross income of $25 million or more
  • You bring in over 50% of your annual revenue from selling the data of California residents

‍

Keep in mind that in this context, “selling” includes leasing or disclosing data or otherwise making data available in exchange for payment. The CCPA also applies to any businesses that share common branding (such as the same name or logo) with a business that meets the criteria for CCPA applicability. CCPA laws do not apply to public, non-profit entities.

‍

‍

What does CCPA compliance involve?

‍

The CCPA awards certain rights to California residents. These rights include:

  • The right to opt out of having their data sold
  • The right to know what data you have collected. If California residents request this information, you must give them a report of all their data you have collected within the past 12 months at no charge to them.
  • The right to request that you delete any information you collected about them
  • The right to equal services and prices regardless of exercising their rights. For example, you can’t charge a user more for your product or service if they have requested that you don’t sell their data.
  • The right to be notified of the data you are collecting

‍

To achieve CCPA compliance, you need to adhere to all of these rights. This includes:

  • Adding notifications to your site, at or before the point when you start collecting data, informing users what data you will be collecting and why
  • Add a link to your site allowing users to opt out of allowing their data to be sold
  • Include an opt-in link for minors under 16 that they must agree to before you can sell their data, as well as an opt-in link for minors under 13 that must be completed by a parent or guardian
  • Within your privacy policy, include a list of users’ rights and a list of what data you collect, disclose, and sell, while updating that list of data annually

‍

‍

Why Is CCPA compliance important?

‍

Understanding how the CCPA can affect your business is critical if you plan to do business with California residents. If your business is required to adhere to the CCPA, your compliance will have an important impact on your bottom line in multiple ways.

‍

To start, there are legal penalties for non-compliance. According to the CCPA, businesses can be fined $7,500 per violation, which can quickly add up to a damaging hit to your balance sheet. Additionally, the law allows California residents to seek compensation if their CCPA rights are violated. The court can fine organizations up to $750 per affected user.

‍

Beyond the immediate financial consequences of CCPA violations, you stand to lose the trust of your users and customers as well. If word gets out that you have a history of violating users’ data privacy rights, your prospects and customers may turn to competitors who are able to demonstrate a history of responsible compliance practices. 

‍

‍

How can I become CCPA compliant?

‍

Achieving CCPA compliance is an urgent priority for company’s that do business with California residents. One way to jumpstart your compliance is to use an automated compliance tools. If your company complies with GDPR, you may already satisfy CCPA controls. An automated compliance tool can easily check your system and provide a report on next steps.From there, you can go through the checklist item by item to complete any requirements you haven’t yet met so you can continue to do business in CA.

Interested in more?

Share your email so Vanta can send you new guides and helpful steps to improve security at your company.

GET STARTED
GET IN TOUCH

PCI Compliance Selection Guide

Determine Your PCI Compliance Level

If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.

When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.

Answer a few short questions and we’ll help identify your compliance level.

1
2
3
4
!
👍

Does your business offer services to customers who are interested in your level of PCI compliance?

Yes
No
RESTART QUIZ

Identify your PCI SAQ or ROC level

The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.

Good news! Vanta supports all of the following compliance levels:

SAQ A

A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.

Get PCI DSS certified

SAQ A-EP

A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

Learn more about eCommerce PCI

SAQ D
for service providers

A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
‍
Use our PCI checklist

ROC
Level 1 for service providers

A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).

Automate your ROC and AOC

Download this checklist for easy reference

DOWNLOAD NOW

Questions?

Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.

The SOC 2 Compliance Checklist

Most businesses look at security compliance as a mountain that is impossible to conquer without an equally mountainous budget and ample time with endless frustrations. The truth is that every organization’s experience will vary, but in most cases, you can achieve compliance and certification easier than you think if you only prepare properly.

That begins with educating yourself about the road ahead and having the right tools in your toolbox, like automated compliance software. If you’re preparing to guide your organization through SOC 2 compliance, our SOC 2 compliance checklist will break down the process and give you a digestible view of the road ahead.

1

Pre-Work for Your SOC 2 Compliance

Choose the right type of SOC 2 report:

A SOC 2 Type 1 report assesses how your organization aligns with the security controls and policies outlined in SOC 2
A SOC 2 Type 2 report has all the components of a Type 1 report with the addition of testing your controls over a period of time
The correct report will depend on the requirements or requests of the client or partner that is requested a SOC 2 report from you

Determine the framework for your SOC 2 report. Of the five Trust Service Criteria in SOC 2, every organization needs to comply with the first criteria (security), but you only need to assess and document the other criteria that apply. Determining your framework involves deciding which Trust Service Criteria and controls are applicable to your business using our Trust Service Criteria Guide.

Estimate the resources you expect to need. This will vary depending on how closely you already align with SOC 2 security controls but it can include several costs such as:

Compliance software
Engineers and potentially consultants
Security tools such as access control systems
Administrative resources to draft security policies
Auditing for your compliance certification

Obtain buy-in from your organization leadership to provide the resources your SOC 2 compliance will need.

2

Work Toward SOC 2 Compliance

Begin with an initial assessment of your system using automated compliance software to determine which necessary controls and practices you have already implemented and which you still need to put in place.

Review your Vanta report to determine any controls and protocols within the “Security” Trust Service Criteria that you do not yet meet and implement these one by one. These are multi-tiered controls across several categories of security, including:

CC1: Control Environment
CC2: Communication and Information
CC3: Risk Assessment
CC4: Monitoring Activities
CC5: Control Activities
CC6: Logical and Physical Access Controls
CC7: System Operations
CC8: Change Management
CC9: Risk Mitigation

Using Vanta’s initial assessment report as a to-do list, address each of the applicable controls in the other Trust Services Criteria that you identified in your initial framework but that you have not yet implemented.

Using Vanta’s initial assessment report, draft security policies and protocols that adhere to the standards outlined in SOC 2. Vanta’s tool includes thorough and user-friendly templates to make this simpler and save time for your team.

Run Vanta’s automated compliance software again to determine if you have met all the necessary criteria and controls for your SOC 2 report and to document your compliance with these controls.

3

Complete a SOC 2 Report Audit

Select and hire an auditor affiliated with the American Institute of Certified Public Accountants (AICPA), the organization that developed and supports SOC 2.

Complete a readiness assessment with this auditor to determine if you have met the minimum standards to undergo a full audit.

If your readiness assessment indicates that there are SOC 2 controls you need to address before your audit, complete these requirements. However, if you have use automated compliance software to guide your preparations and your SOC 2 compliance, this is unlikely.

Undergo a full audit with your SOC 2 report auditor. This may involve weeks or longer of working with your auditor to provide the documentation they need. Vanta simplifies your audit, however, by compiling your compliance evidence and documentation into one platform your auditor can access directly.

When you pass your audit, the auditor will present you with your SOC 2 report to document and verify your compliance.

4

Maintain Your SOC 2 Compliance Annually

Establish a system or protocol to regularly monitor your SOC 2 compliance and identify any breaches of your compliance, as this can happen with system updates and changes.

Promptly address any gaps in your compliance that arise, rather than waiting until your next audit.

Undergo a SOC 2 re-certification audit each year with your chosen SOC 2 auditor to renew your certification.

Prioritizing Your Security and Opening Doors with SOC 2 Compliance

Information security is a vital priority for any business today from an ethical standpoint and from a business standpoint. Not only could a data breach jeopardize your revenue but many of your future clients and partners may require a SOC 2 report before they consider your organization. Achieving and maintaining your SOC 2 compliance can open countless doors, and you can simplify the process with the help of the checklist above and Vanta’s compliance automation software. Request a demo today to learn more about how we can help you protect and grow your organization.

Download this checklist for easy reference

DOWNLOAD NOW

“Getting our SOC 2 and HIPAA was an absolute game-changer for the way that Nayya is able to sell into larger companies.”

Akash Magoon
Co-Founder + Chief Technology Officer  |  Nayya

Related guides

HIPAA

The Ultimate HIPAA Compliance Guide and Checklist

Everything you need to know about HIPAA Compliance
SOC 2

Security Reviews for Startups

How to navigate questionnaires & third party audits
SOC 2

Vanta's SOC 2 Certification Guide

A comprehensive introduction to SOC 2 Compliance Certification

Vanta is the easy way to get SOC 2, HIPAA, or ISO 27001 compliant. Over 3,000 fast-growing companies trust Vanta to automate their security monitoring and get ready for security audits in weeks instead of months. Simply connect your tools to Vanta, fix the gaps on your dashboard, and then work with a Vanta-trained auditor to complete your audit. We'll guide you throughout the process and help tailor your security monitoring and compliance to meet the needs of you and your customers. Vanta was founded in 2016 and headquartered in San Francisco.

Products
SOC 2HIPAAISO 27001PCI DSSGDPRIntegrations
Customers
Customer Case Studies
Resources
BlogGuidesGlossaryWebinarsIndustry Topics
Company
AboutCareersPressSecuritySystem Status
Manage CookiesTermsPrivacy
Vanta automates security compliance.
Please enter your first name
Please enter your last name
Please enter a valid email address
Please enter a job title
Please enter your company name
Please enter your company website
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

By clicking “Accept”, you agree to the use of cookies on your device in accordance with our Privacy and Cookie policies.

Manage CookiesACCEPT
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.