You can run CCPA and CPRA compliance on spreadsheets if your request volume is low and your data flows are few. Build four tabs: data inventory, vendors, requests log and notices. Move to automation when request volume, system count or evidence demands outgrow what one person can keep accurate.
First, does the law apply to you?
The California Attorney General's page says the CCPA applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling California residents' personal information. The $25 million figure is adjusted over time, and the CalPrivacy agency publishes current monetary thresholds, so check the page before relying on it.
Consumers have the right to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination. The CPRA amended the CCPA from 1 January 2023; it did not create a separate law.
The four-tab workbook
Tab 1, data inventory. One row per system or data flow: what personal information, which categories, source, purpose, where stored, who it is shared with, whether it is sold or shared, retention, and whether it includes sensitive personal information. This feeds your notice at collection and privacy policy.
Tab 2, vendors and recipients. Service providers, contractors and third parties, with contract status and what each receives. Contract terms matter because they affect how data transfers are classified.
Tab 3, requests log. One row per consumer request: date received, channel, type, identity verification, status, due date, outcome, and notes. The AG's FAQ states businesses must respond to requests to know within 45 calendar days and may extend by another 45 days with notice. Opt-out requests must be honoured as soon as feasibly possible and no later than 15 business days. Build due date formulas from these rules.
Tab 4, notices and links. The notice at collection, privacy policy, Do Not Sell or Share link, and any limit use link, with page URLs and last review date. Include whether you honour opt-out preference signals such as Global Privacy Control, which the AG describes as a valid way to opt out.
Where spreadsheets hold up
Low volumes of consumer requests. A small set of systems. One person who owns privacy. Quarterly review cycles. A dated copy of each tab at each review serves as basic evidence.
Where they break
- Requests arrive from many channels and nobody sees the whole picture.
- Deletion has to reach multiple systems and vendors; a spreadsheet cannot show whether each step completed.
- Opt-out signals arrive automatically from browsers and must be applied without a human in the loop.
- The data inventory goes stale because engineers ship changes without telling the privacy owner.
- New regulations add duties. CalPrivacy completed regulations on cybersecurity audits, risk assessments and automated decisionmaking technology, effective 1 January 2026 per its site. Check the compliance dates that apply to you.
- An auditor or regulator asks for proof, and the evidence is scattered across personal drives.
Signs it is time to automate
Requests per month make the log a daily chore. More than a handful of systems store personal data. Sales cycles stall on privacy questionnaires. You cannot answer "which vendors receive this category of data" in a minute. Version control on the workbook is a mess.
What to do
- Confirm applicability using the three tests and keep the working in a note.
- Build the four tabs and fill the data inventory by interviewing each team.
- Protect the workbook with edit rights for named owners and keep a change log.
- Add formulas for request due dates and an overdue flag.
- Set a quarterly review and save a dated copy.
- Add a privacy check to your engineering change process so new data flows reach the inventory.
- Track hours spent per month; when it grows, plan the move to tooling.
Quick check
Is a spreadsheet acceptable to regulators?
The sources we reviewed do not prohibit it. What matters is accurate records, timely responses and working notices.
Do I need to verify identity for opt-out requests?
The AG's FAQ says businesses are not required to verify opt-out requests, though they may ask limited questions to find the right record.
How Safeguard helps automate this
Spreadsheets fail at the technical edge: knowing what your code and dependencies really do. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, saving the team time for other work. Technical evidence for the security side of privacy comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not make you CCPA compliant or replace legal advice. Book a call.
Sources
- California Attorney General: CCPA (updated 28 August 2026 per the page)
- California Privacy Protection Agency (CalPrivacy): laws and regulations
Last reviewed: 18 October 2026.
