← All checklists
CCPA and CPRA readiness checklist
Every CCPA and CPRA obligation a business has to act on, mapped to its Civil Code section or CCPA regulation, with the evidence the California Privacy Protection Agency or Attorney General will ask for. Preview 8 of the 61 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers CCPA as amended by CPRAReviewed 30 Oct 202661 items · 8 sections
Scope and data mapping
7 items
- 1798.140
(d) Confirm you are a covered business: annual gross revenue above the inflation-adjusted threshold (originally $25 million), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing it.Evidence: Applicability memo with revenue and volume figures.
Notices and privacy policy
8 items
- 1798.100
(a) At or before collection, tell consumers the categories of personal and sensitive personal information collected, the purposes, whether it is sold or shared, and how long it is kept.Evidence: Notice at collection on every collection point.
Right to know, delete and correct
8 items
- 1798.110On a verified request to know, disclose the categories and specific pieces of personal information, sources, purposes and categories of recipients.Evidence: Request to know response template and completed samples.
Handling consumer requests
9 items
- 1798.130
(a) Offer at least two methods to submit requests to know, delete and correct, including a toll-free number, unless you operate only online and have a direct relationship with the consumer, in which case email is enough.Evidence: Request channels listed in the privacy policy.(1)
Opt-out of sale and sharing
9 items
- 1798.120
(a) Let consumers opt out of the sale or sharing of their personal information at any time.Evidence: Opt-out mechanism and processed opt-out records.
Sensitive personal information and minors
6 items
- 1798.121
(a) Let consumers limit the use of sensitive personal information to what is necessary to provide the goods or services they requested.Evidence: Limit mechanism and records of processed requests.
Service providers, contractors and incentives
6 items
- Regs 7051Sign contracts with every service provider and contractor that bar selling or sharing, limit use to the specified business purpose, and give you audit and remediation rights.Evidence: Signed agreements mapped to the Regs 7051 terms.
Security, breach and assessments
8 items
- 1798.100
(e) Implement reasonable security procedures appropriate to the nature of the personal information you hold.Evidence: Information security program and recent risk assessment.
Changelog
- v1.030 Oct 2026First release. Covers the CCPA as amended by the CPRA and the CCPA regulations, including opt-out preference signals, sensitive data limits and the 2026 rules on risk assessments, cybersecurity audits and ADMT.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.