CCPA / CPRA Compliance
California privacy compliance with the security to back it up.
Data inventory, consumer request workflow, privacy notices and reasonable security safeguards under the CCPA as amended by the CPRA.
What it is
The California Consumer Privacy Act, expanded by the CPRA, gives California residents rights over their personal data: to know, delete, correct, and opt out of sale or sharing. It applies to businesses over the revenue threshold or that handle personal data of 100,000 or more consumers or households. The law also requires reasonable security, and the private right of action for breaches is where the real financial exposure sits.
Who needs it
- California businesses above the $25M revenue threshold
- E-commerce, marketing and data-driven companies of any size handling 100,000+ consumers
- Companies that sell or share personal data for advertising
- Service providers processing personal data on behalf of covered businesses
What we do
- Applicability assessment and personal data inventory
- Privacy notice, opt-out and Global Privacy Control handling
- Consumer request intake, verification and fulfillment workflow
- Service provider and contractor agreement review
- Reasonable security safeguards implemented and documented
- Annual risk assessment and cybersecurity audit readiness
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
Does the CCPA apply to my business?
It applies if you do business in California and meet any one threshold: more than $25 million in annual revenue, buying, selling or sharing the personal data of 100,000 or more consumers or households, or deriving half or more of revenue from selling or sharing personal data.
How quickly must we respond to a consumer request?
Requests to know, delete or correct must be acknowledged within 10 business days and fulfilled within 45 calendar days, extendable once by another 45 days with notice.
What does the CCPA require for security?
Businesses must implement reasonable security procedures. The private right of action allows consumers to sue for statutory damages after a breach caused by a failure to do so, which is where most financial exposure sits.
What are the CPRA risk assessment and cybersecurity audit rules?
Regulations finalized in 2025 require annual risk assessments for high-risk processing and independent cybersecurity audits for larger businesses, phased in by revenue from 2028.
Do you serve businesses outside California?
Yes. Any business with California customers can be covered; we work with clients nationwide.
Find out where you stand on CCPA / CPRA.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.