The CCPA has no certification audit. Evidence matters because the California Attorney General or CalPrivacy can investigate, consumers can sue after certain data breaches, and customers send diligence questions. Keep a dated record of your notices, request handling, vendor terms, opt-out processing and security practices so you can answer quickly and consistently.
Who can ask, and about what?
According to the Attorney General's FAQ, most CCPA violations can be pursued only by the Attorney General or the California Privacy Protection Agency, which is branded CalPrivacy. Consumers can sue only for certain data breaches caused by failure to maintain reasonable security practices, with statutory damages of up to $750 per incident, and only after written notice and a 30 day chance to cure. CalPrivacy also enforces the Delete Act for data brokers. So two kinds of proof matter: that you operate the privacy program, and that your security was reasonable.
Evidence for the privacy program
Notices. Dated copies of your notice at collection and privacy policy, with a change history. The AG says the notice at collection must list categories of personal information collected and purposes, and link to the privacy policy. Capture screenshots of where the links appear on your site and app.
Opt-out and limit mechanisms. Evidence that a Do Not Sell or Share link exists if you sell or share, that it works without requiring an account, and that opt-out preference signals such as Global Privacy Control are honoured. Keep test records: date, browser, signal sent, resulting state.
Request log. Every request with dates received and answered, type, verification steps, outcome and any extension notice. The AG states requests to know get a response within 45 calendar days, extendable by 45 more with notice, and opt-outs within 15 business days at most. A log that shows you hit these is your best evidence.
Deletion proof. For each deletion, which systems were cleared, which service providers were told, and any exception relied on, such as a legal retention duty.
Data inventory and records of processing. The living map that supports your notices.
Vendor terms. Contracts and the categories each recipient gets.
Training. Records that staff who handle requests were trained.
Evidence for reasonable security
The breach lawsuit route turns on whether you maintained reasonable security procedures. Keep evidence of encryption, access controls, patching and vulnerability handling, logging, incident response tests and employee security training. CalPrivacy's regulations on cybersecurity audits, risk assessments and automated decisionmaking technology took effect on 1 January 2026 per its site, with their own compliance dates, so check which duties apply to you and when.
How to run an inquiry
- Route anything from a regulator or counsel to one owner immediately.
- Preserve records and pause routine deletion of relevant logs.
- Read the request carefully and answer what is asked, in writing, with evidence attached.
- Keep a log of what you provided and when.
- Involve legal counsel before sending substantive responses.
What to do now
- Create an evidence folder per quarter with notices, screenshots, request log export and vendor list.
- Run a quarterly test of opt-out links and signals and file the results.
- Reconcile the request log against support tickets to find missed requests.
- Review your breach and security evidence monthly.
- Write a one page inquiry response plan naming owners.
- Do a mock inquiry: ask a colleague to request your proof of five items and time the response.
Quick check
Is there a CCPA certification?
Not in the sources we reviewed. The law is enforced by the Attorney General and CalPrivacy, and there is no certification audit.
How long should I keep request records?
We did not confirm a retention period in the pages we fetched. Ask counsel and check the current regulations.
How Safeguard helps automate this
Evidence for reasonable security is the part teams struggle to assemble on demand. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, which saves time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies and other findings; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not replace legal counsel or guarantee any outcome with a regulator.
Open the framework mapping demo or book a call.
Sources
- California Attorney General: CCPA
- California Privacy Protection Agency (CalPrivacy): laws and regulations
Last reviewed: 18 October 2026.
