About this Framework
The California Consumer Privacy Act (CCPA), as significantly amended by Proposition 24 (CPRA — California Privacy Rights Act), grants California consumers enforceable rights over their personal information: right to know, delete, correct, opt-out of sale/sharing, and limit use of sensitive personal information (SPI). CPRA created the California Privacy Protection Agency (CPPA) for dedicated enforcement, introduced data minimisation, purpose limitation and retention requirements. Businesses that intentionally violate the regulation face $7,500 per violation with the CPPA conducting proactive audit investigations.
Key Control Domains
Consumer Privacy Rights (Know/Delete/Correct/Opt-Out/Limit)
Sensitive Personal Information (SPI) Controls
Data Minimisation & Purpose Limitation
Retention Limits & Data Lifecycle
Privacy Notices & Disclosures
Service Provider & Contractor Agreements
Data Protection Assessments (DPAs)
Opt-Out of Sale/Sharing
CPPA Enforcement & Regulatory Audits
Who Needs This?
- Businesses meeting CCPA thresholds (annual revenues >$25M, or data on 100,000+ CA consumers)
- Data brokers registered with and operating in California
- Any organisation collecting personal information from California residents
- SaaS, technology and e-commerce companies with California users
Compliance Benefits
- Legal compliance and avoidance of CPPA enforcement actions and per-violation fines
- Model framework for compliance with other U.S. state privacy laws (Virginia, Colorado, Texas)
- Enhanced consumer trust and data governance maturity
- Structured data inventory and processing records programme
Official Reference
California Privacy Protection Agency
https://cppa.ca.gov/
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/california-consumer-privacy-act-ccpa-cpra