Your CCPA guide to data privacy compliance

Data privacy has become an increasingly crucial concern for organizations and individuals alike. In addition to cyber attacks and identity theft, data is being leveraged as a way to target users for political and commercial messages.
To protect residents and secure data privacy, California has implemented sweeping legislation that will affect many organizations who wish to do business in the state. Here’s what you’ll need to know about California’s new regulations.
What Is CCPA?
CCPA is the California Consumer Privacy Act. This law, passed by the California state legislature, sets requirements for how businesses need to handle the personal data of California residents. It also gives specific rights to California residents regarding their personal data, and businesses are required to respect and grant those rights. The CCPA took effect in January of 2020, and it is the first law of its kind in the U.S., however; it shares many elements and frameworks with the UK’s General Data Protection Regulation (GDPR).
Who needs to comply with CCPA?
A core difference between CCPA and GDPR is that the CCPA applies to more specific organizations with narrower criteria.
The CCPA applies to all for-profit businesses that sell the data of California residents beyond a certain threshold. For-profit businesses located anywhere in the world must follow the CCPA if they meet at least one of these criteria:
- You sell the personal information of over 50,000 California residents per year
- You have an annual gross income of $25 million or more
- You bring in over 50% of your annual revenue from selling the data of California residents
Keep in mind that in this context, “selling” includes leasing or disclosing data or otherwise making data available in exchange for payment. The CCPA also applies to any businesses that share common branding (such as the same name or logo) with a business that meets the criteria for CCPA applicability. CCPA laws do not apply to public, non-profit entities.
What does CCPA compliance involve?
The CCPA awards certain rights to California residents. These rights include:
- The right to opt out of having their data sold
- The right to know what data you have collected. If California residents request this information, you must give them a report of all their data you have collected within the past 12 months at no charge to them.
- The right to request that you delete any information you collected about them
- The right to equal services and prices regardless of exercising their rights. For example, you can’t charge a user more for your product or service if they have requested that you don’t sell their data.
- The right to be notified of the data you are collecting
To achieve CCPA compliance, you need to adhere to all of these rights. This includes:
- Adding notifications to your site, at or before the point when you start collecting data, informing users what data you will be collecting and why
- Add a link to your site allowing users to opt out of allowing their data to be sold
- Include an opt-in link for minors under 16 that they must agree to before you can sell their data, as well as an opt-in link for minors under 13 that must be completed by a parent or guardian
- Within your privacy policy, include a list of users’ rights and a list of what data you collect, disclose, and sell, while updating that list of data annually
Why Is CCPA compliance important?
Understanding how the CCPA can affect your business is critical if you plan to do business with California residents. If your business is required to adhere to the CCPA, your compliance will have an important impact on your bottom line in multiple ways.
To start, there are legal penalties for non-compliance. According to the CCPA, businesses can be fined $7,500 per violation, which can quickly add up to a damaging hit to your balance sheet. Additionally, the law allows California residents to seek compensation if their CCPA rights are violated. The court can fine organizations up to $750 per affected user.
Beyond the immediate financial consequences of CCPA violations, you stand to lose the trust of your users and customers as well. If word gets out that you have a history of violating users’ data privacy rights, your prospects and customers may turn to competitors who are able to demonstrate a history of responsible compliance practices.
How can I become CCPA compliant?
Achieving CCPA compliance is an urgent priority for company’s that do business with California residents. One way to jumpstart your compliance is to use an automated compliance tools. If your company complies with GDPR, you may already satisfy CCPA controls. An automated compliance tool can easily check your system and provide a report on next steps.From there, you can go through the checklist item by item to complete any requirements you haven’t yet met so you can continue to do business in CA.

Interested in more?
Share your email so Vanta can send you new guides and helpful steps to improve security at your company.