For CCPA as amended by CPRA, collect proof that your notices are current, that consumer requests are answered on time, that opt outs including Global Privacy Control signals are honored, and that your security is reasonable. Much of it can be exported automatically. Judgment calls stay with people.
What does the law ask of a business?
The California Attorney General's page summarizes the rights: to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non discrimination. It lists obligations such as a notice at collection and a privacy policy, at least two request methods, a "Do Not Sell or Share My Personal Information" link where that applies, and honoring opt out preference signals such as GPC. CPRA amended the CCPA from 1 January 2023, adding correction and limit rights.
Time limits matter for evidence. The page says to respond to requests to know, delete and correct within 45 calendar days, extendable by 45 more with notice, and to opt out requests as soon as feasible and no later than 15 business days.
It also says private lawsuits are available only for certain breaches of unencrypted, unredacted data caused by a failure to maintain reasonable security, with statutory damages up to $750 per incident. That ties security evidence to legal exposure.
The page does not address business record keeping requirements, so ask counsel what you must retain and for how long.
What evidence is worth collecting?
Requests. A log of every request: type, date received, date verified, date answered, outcome, and the extension notice if one was used. Time to respond is the metric an enforcer would ask for.
Opt outs. Test results showing that a browser sending a GPC signal gets opted out on your site, and that the downstream systems stopped sharing. Date each test.
Notices. Dated copies of your privacy policy and notice at collection, with change history.
Data inventory. What personal information you collect, sources, purposes and recipients. Your answers to a request to know come from here.
Vendor records. Contracts and a list of service providers, plus how deletion requests reach them.
Security. Scan results, access reviews, encryption status, patch records, and an SBOM per release to show what software touches the data.
What can be automated?
Exports from a request tracker, scheduled GPC tests, configuration snapshots, vulnerability scans and access lists can all run on a timer. Safeguard's compliance automation can gather the technical items and map them to control language. It does not make you compliant. Whether a practice meets the law is for your counsel to decide.
How often?
- Per event: each request, each incident, each notice change.
- Monthly: request response times and open items, opt out test.
- Quarterly: access review, vendor list review, restore test.
- Yearly: data inventory refresh, policy review, training.
What to do
- Create a request log with the fields listed above.
- Set a reminder at day 30 for every open request.
- Test GPC handling monthly and save the result.
- Keep dated copies of the policy and notice at collection.
- Refresh your data inventory when you launch a feature that collects data.
- Export security evidence on a schedule and store it with dates.
- Ask counsel what you must retain.
Quick check
How long do I have to answer a request to delete?
According to the California Attorney General, 45 calendar days, extendable by 45 more days with notice.
Is CPRA a separate law?
The Attorney General says CPRA amended the CCPA, so the combined law is usually called the CCPA as amended.
Sources
Last reviewed: 18 October 2026.
