The CCPA, as amended by the CPRA, covers a for-profit business in California that meets one of three tests: more than $25 million in annual gross revenue, buying, selling or sharing the data of 100,000 or more consumers or households, or earning half of revenue from selling or sharing it. Test these first, then map your data.
Does the law apply to you?
Start with the three thresholds on the California Attorney General's CCPA page. The revenue figure is tied to an inflation adjustment mechanism in the statute, so confirm the current number with the California Privacy Protection Agency before you write it into a memo. Nonprofits and government agencies are generally outside the law.
Two details trip people up. The 100,000 count includes households and counts data you buy or share, not just data you collect directly. And the statute also reaches an entity that controls or is controlled by a covered business and shares common branding with it, so a small subsidiary can be pulled in by its parent.
Write the answer down as a one page scoping memo: which threshold you meet, the date you checked, who signed off. That memo is your first piece of evidence.
Whose data is in scope?
The employee and business to business exemptions expired on December 31, 2022. If you hold personal information about staff, job applicants, contractors, or contacts at customer companies, it is in scope alongside consumer data. Many first timers scope only the marketing site and miss HR systems.
Personal information is broader than names and emails. Device identifiers, IP addresses, purchase history and inferences drawn from them all count when they can be linked to a consumer or household. Sensitive personal information has its own list, including government identifiers, precise geolocation, account log in details with access codes, the contents of private messages, biometric and genetic data, and health data.
What is the boundary of the data map?
Scope is a picture of where personal information lives and moves. Build it as a table with one row per system and these columns: data categories, source, purpose, retention, who receives it, and whether it is sold or shared.
Cover production databases, analytics tools, support desks, email platforms, backups, data warehouses and the logs your engineers forget. Add the code side too: SDKs, tags and third party scripts on your website often send data out without anyone deciding to.
Which vendors are service providers and which are third parties?
The role decides what your contract must say and whether a disclosure counts as a sale or share. Sort every recipient into one of three groups: service provider or contractor (processes on your behalf under a written contract that limits use), third party (receives data for its own purposes), or you as a business. A vendor that uses your data to build advertising profiles is not a service provider just because you call it one.
Pull each contract, check that the use limits and deletion assistance terms are there, and flag the gaps. Advertising and analytics tags are where "sharing" for cross context behavioral advertising most often hides.
What should you leave for later?
Scoping is not the place to draft every notice. But note three upcoming items so the boundary does not shift under you. The CPPA's regulation package on risk assessments, cybersecurity audits and automated decisionmaking technology was approved in 2025. Secondary summaries put phased deadlines from 2027 to 2030, and they disagree on some risk assessment dates, so read the final text on the CPPA site before you plan around any date.
What to do
- Test the three thresholds with current figures and record the result, date and approver.
- Check whether a parent or affiliate with common branding changes the answer.
- List every system holding personal information, including HR, support, analytics and backups.
- Tag each data category as ordinary or sensitive, and note whether it relates to consumers, employees or business contacts.
- Sort every recipient into service provider, contractor or third party, and pull the contract for each.
- Scan your website and apps for tags and SDKs that send data out, and add them to the map.
- Set an owner and a review date, because scope changes whenever you add a tool.
Quick check
Does a company outside California have to comply?
It can. The test is whether you do business in California and meet a threshold, not where your office sits.
Do employee records count?
Yes. The employee exemption expired on December 31, 2022, so staff and applicant data is in scope.
How Safeguard helps automate this
A data map goes stale the week after you finish it. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, which helps you spot third party libraries and SDKs that touch personal data. Monitoring runs between reviews, which frees your team for other work. If you choose, the agent can open tested fix pull requests, but it is off by default and every category starts on Manual. Safeguard helps prepare and keep evidence ready; your counsel and any assessor make the calls. Book a call to see it.
Open the framework mapping demo
Sources
- California Attorney General, CCPA page
- CCPA statute text, California Privacy Protection Agency
- CPPA regulations page
Last reviewed: 18 October 2026.
