A 12 week CCPA and CPRA plan runs in four blocks: weeks 1 to 3 find out if you are covered and map personal information, weeks 4 to 6 fix notices and the privacy policy, weeks 7 to 9 build request and opt-out handling, and weeks 10 to 12 cover vendors, training and a test run. The 12 weeks is our planning suggestion, not a legal period.
The California Attorney General's CCPA page, fetched on 18 October 2026, is our main source. It is a consumer facing summary, not legal advice, so have counsel review your final approach.
Are you covered?
The AG page says the law applies to for-profit businesses doing business in California that meet any one threshold: gross annual revenue over 25 million dollars, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50 percent or more of annual revenue from selling California residents' personal information. Thresholds can be adjusted over time, so check the current figures. The California Privacy Protection Agency page lists CCPA regulations effective 1 January 2026 and a package on cybersecurity audits, risk assessments and automated decisionmaking technology adopted in September 2025, with effective dates to be read from the linked documents.
Weeks 1 to 3: scope and map
Week 1. Check the thresholds, name an owner, collect your existing privacy policy and vendor list. Week 2. Build a data inventory: categories of personal information, sources, purposes, where stored, who receives it, retention. Week 3. Mark what is sold or shared (including advertising and analytics tags), and what counts as sensitive personal information such as precise geolocation or financial account data.
Weeks 4 to 6: notices
Week 4. Draft the notice at collection. The AG page says it must be given at or before collection, list categories and purposes, and link to the privacy policy. Week 5. Rewrite the privacy policy so it describes your practices and explains how to use each right: know, delete, correct, opt out of sale or sharing, and limit use of sensitive information. Week 6. Publish, then check every web form, app screen and email capture shows the notice.
Weeks 7 to 9: requests and opt-outs
Week 7. Set up intake channels and an identity check proportionate to the request. Create a request log with received date, type, due date, outcome. Week 8. Write response playbooks. The AG page gives 45 calendar days for requests to know, delete and correct, extendable by 45 more with notice to the consumer, and up to 15 business days for opt-outs. Week 9. If you sell or share, add the "Do Not Sell or Share My Personal Information" link and honor a global privacy control signal. The page says businesses cannot require an account to opt out and must wait 12 months before asking a consumer to opt in again.
Weeks 10 to 12: vendors, training, test
Week 10. Review contracts with service providers and anyone receiving personal information. The AG page does not list the required contract terms, so take those from the statute and regulations with counsel. Week 11. Train staff who touch requests, such as support and marketing. Cover recognition of requests that come through any channel. Week 12. Run a test: submit a mock know request, a delete request and an opt-out. Time each against the deadlines and fix what broke.
Security counts too
The AG page says private lawsuits are limited to certain data breaches caused by a failure to maintain reasonable security, with statutory damages of up to 750 dollars per incident after a 30 day cure notice. Document your security controls beside the privacy work.
What to do
- Confirm coverage with current figures and counsel.
- Complete the data inventory before touching notices.
- Publish a matching notice at collection and privacy policy.
- Stand up request intake with a deadline tracker.
- Honor opt-out signals and test them.
- Review vendor contracts and train staff.
- Retest every quarter and after any new data use.
Quick check
How long do I have to answer a CCPA request?
Per the California Attorney General, 45 calendar days for know, delete and correct requests, extendable once by 45 days with notice, and no later than 15 business days for opt-outs.
Does honoring a global privacy control matter?
Yes. The AG page says a user enabled global privacy control is an acceptable opt-out method and that covered businesses must honor it.
How Safeguard helps automate this
Safeguard focuses on the technical side of privacy and security evidence. Its compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, saving time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, which helps show reasonable security. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard does not give legal advice or make you compliant. Book a call to see it.
Sources
- California Attorney General: CCPA, fetched 18 October 2026
- California Privacy Protection Agency: regulations, fetched 18 October 2026
Last reviewed: 18 October 2026.
