When a customer questionnaire asks about CCPA or CPRA, answer with specifics: whether you act as a business or a service provider, how you handle consumer requests, what security you maintain, and what evidence you can share. Do not claim certification, and have privacy counsel review every legal statement before it goes out.
This post explains how to prepare answers. It is not legal advice, and no software tool makes a company compliant with California law.
Why do these questions show up?
Customers who are covered by the law need their vendors to support it. The California Attorney General's page says a business must meet one of three tests: more than 25 million dollars in annual gross revenue, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50 percent or more of revenue from selling it. The CPRA, approved by voters in November 2020, amended the CCPA, and its changes took effect on 1 January 2023.
What is your role: business or service provider?
Answer this first, because the other answers depend on it. The Attorney General notes that businesses, not service providers, are responsible for responding to consumer requests, and that a service provider may deny a request sent to it directly. If a customer sends you a deletion request, you need a defined way to pass it on or act on it under your contract.
State your role per product or data flow. Avoid one blanket claim.
How should you answer the rights questions?
Questionnaires often list consumer rights. According to the Attorney General, they include:
- Know: categories and specific pieces of information collected, sources, purposes and recipients, up to twice a year, free.
- Delete, with service providers also deleting, subject to exceptions.
- Correct inaccurate information, added 1 January 2023.
- Opt out of sale or sharing, including through a global privacy control signal.
- Limit use of sensitive personal information, also added 1 January 2023.
- Non discrimination for exercising a right.
For each, describe the intake channel, who handles it, the target response time you actually meet, and how you confirm the request. Do not invent timelines you do not follow.
What about security questions?
The Attorney General's page ties the limited private right of action for data breaches to a business's failure to maintain reasonable security procedures and practices, with statutory damages of up to 750 dollars per incident after notice and a cure period. The page does not set out a security checklist, so questionnaires usually borrow from other frameworks.
Answer with what you can evidence: access controls, encryption practices, vulnerability and dependency management, incident response and vendor reviews. Offer a document, not an adjective. "We maintain reasonable security" is weak. "Here is our incident response policy and last test date" is stronger.
What is new for 2026?
The California Privacy Protection Agency announced on 23 September 2025 that new regulations were approved, effective 1 January 2026, covering cybersecurity audits, risk assessments and automated decisionmaking technology. Per the agency:
- Cybersecurity audit certifications are due by 1 April 2028 for businesses above 100 million dollars in revenue, 1 April 2029 for those between 50 and 100 million, and 1 April 2030 for those below 50 million.
- Risk assessments apply from 1 January 2026, with an attestation and summary due by 1 April 2028.
- Businesses using ADMT for significant decisions must comply from 1 January 2027.
Expect customers to start asking whether you can support audit evidence. The pages we fetched did not say which businesses must audit, so read the regulation text or ask counsel.
How does software supply chain fit?
Questionnaires increasingly ask how you know what is in your software. A current SBOM, a dependency policy and a record of how you triage vulnerabilities all answer that honestly. Safeguard can help produce this kind of evidence through its CLI, web app and compliance automation, but it does not certify you for CCPA or CPRA.
What to do
- Decide and write down your role for each data flow.
- Document the intake and handling path for each consumer right.
- Collect security evidence: policies, test dates, SBOMs, vendor review records.
- Keep a single approved answer library, reviewed by counsel, and date each entry.
- Say "no" or "not yet" when true, and add the plan.
- Calendar the 2028 to 2030 audit dates against your revenue band.
Quick check
Can we say we are CCPA certified?
No. The Attorney General's page describes no certification for CCPA compliance. Describe your practices and evidence instead.
Who answers a consumer request that reaches a vendor?
The business is responsible. A service provider may deny a request sent directly, so agree a hand off in the contract.
Sources
- California Attorney General, California Consumer Privacy Act
- CPPA, CCPA updates and regulations
- CPPA announcement, 23 September 2025
Last reviewed: 18 October 2026.
