Share this article
Your CCPA guide to data privacy compliance
Data privacy has become an increasingly crucial concern for organizations and individuals alike. In addition to cyber attacks and identity theft, data is being leveraged as a way to target users for political and commercial messages.
To protect residents and secure data privacy, California has implemented sweeping legislation that will affect many organizations who wish to do business in the state. Here’s what you’ll need to know about California’s new regulations.
What Is CCPA?
CCPA is the California Consumer Privacy Act. This law, passed by the California state legislature, sets requirements for how businesses need to handle the personal data of California residents. It also gives specific rights to California residents regarding their personal data, and businesses are required to respect and grant those rights. The CCPA took effect in January of 2020, and it is the first law of its kind in the U.S., however; it shares many elements and frameworks with the UK’s General Data Protection Regulation (GDPR).
Who needs to comply with CCPA?
A core difference between CCPA and GDPR is that the CCPA applies to more specific organizations with narrower criteria.
The CCPA applies to all for-profit businesses that sell the data of California residents beyond a certain threshold. For-profit businesses located anywhere in the world must follow the CCPA if they meet at least one of these criteria:
- You sell the personal information of over 50,000 California residents per year
- You have an annual gross income of $25 million or more
- You bring in over 50% of your annual revenue from selling the data of California residents
Keep in mind that in this context, “selling” includes leasing or disclosing data or otherwise making data available in exchange for payment. The CCPA also applies to any businesses that share common branding (such as the same name or logo) with a business that meets the criteria for CCPA applicability. CCPA laws do not apply to public, non-profit entities.
What does CCPA compliance involve?
The CCPA awards certain rights to California residents. These rights include:
- The right to opt out of having their data sold
- The right to know what data you have collected. If California residents request this information, you must give them a report of all their data you have collected within the past 12 months at no charge to them.
- The right to request that you delete any information you collected about them
- The right to equal services and prices regardless of exercising their rights. For example, you can’t charge a user more for your product or service if they have requested that you don’t sell their data.
- The right to be notified of the data you are collecting
To achieve CCPA compliance, you need to adhere to all of these rights. This includes:
- Adding notifications to your site, at or before the point when you start collecting data, informing users what data you will be collecting and why
- Add a link to your site allowing users to opt out of allowing their data to be sold
- Include an opt-in link for minors under 16 that they must agree to before you can sell their data, as well as an opt-in link for minors under 13 that must be completed by a parent or guardian
- Within your privacy policy, include a list of users’ rights and a list of what data you collect, disclose, and sell, while updating that list of data annually
Why Is CCPA compliance important?
Understanding how the CCPA can affect your business is critical if you plan to do business with California residents. If your business is required to adhere to the CCPA, your compliance will have an important impact on your bottom line in multiple ways.
To start, there are legal penalties for non-compliance. According to the CCPA, businesses can be fined $7,500 per violation, which can quickly add up to a damaging hit to your balance sheet. Additionally, the law allows California residents to seek compensation if their CCPA rights are violated. The court can fine organizations up to $750 per affected user.
Beyond the immediate financial consequences of CCPA violations, you stand to lose the trust of your users and customers as well. If word gets out that you have a history of violating users’ data privacy rights, your prospects and customers may turn to competitors who are able to demonstrate a history of responsible compliance practices.
How can I become CCPA compliant?
Achieving CCPA compliance is an urgent priority for company’s that do business with California residents. One way to jumpstart your compliance is to use an automated compliance tools. If your company complies with GDPR, you may already satisfy CCPA controls. An automated compliance tool can easily check your system and provide a report on next steps.From there, you can go through the checklist item by item to complete any requirements you haven’t yet met so you can continue to do business in CA.
No items found.
FEATURED VANTA RESOURCE
The ultimate guide to scaling your compliance program
Learn how to scale, manage, and optimize alongside your business goals.
PCI Compliance Selection Guide
Determine Your PCI Compliance Level
If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.
When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.
Answer a few short questions and we’ll help identify your compliance level.
1
2
3
4
!
👍
Does your business offer services to customers who are interested in your level of PCI compliance?
Identify your PCI SAQ or ROC level
The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.
Good news! Vanta supports all of the following compliance levels:
SAQ A
A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.
Get PCI DSS certified
SAQ A-EP
A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.
Learn more about eCommerce PCI
SAQ D
for service providers
A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
Use our PCI checklist
ROC
Level 1 for service providers
A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).
Automate your ROC and AOC
Download this checklist for easy reference
Questions?
Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.
Related resources
The compliance news you need. Delivered securely to your inbox.
Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes
