A first security hire at a company covered by the CCPA can make the law practical with one tool: a map of where personal information lives. Requests to know, delete or correct only work when every system on the map can be searched and changed. Start there.
What is the job here?
California's Attorney General describes the CCPA, as amended by the CPRA, as giving consumers rights to know, delete, opt out of sale or sharing, correct, and limit use of sensitive personal information, along with non discrimination. Businesses must respond to requests and publish notices describing their privacy practices. Privacy counsel usually owns interpretation. You own whether the company can actually do what the notices say.
How do I build the map?
Start from systems, not forms. List every place personal information is stored or sent: production databases, data warehouse, logs, backups, support tools, marketing tools, vendors, analytics. For each, record what data, why it is collected, who can access it, how long it stays and whether it leaves to a third party.
Constructed example: a 90 person company discovers during mapping that customer emails appear in application logs kept for a year, in a support tool, in a marketing platform and in a data warehouse used by analysts. A deletion request that only touches the production database leaves four copies behind. The map exposes that before a request does.
How do requests flow through it?
Draw the path for each right.
Know: which systems must be queried, who exports, and who reviews before sending to avoid disclosing someone else's data.
Delete: which systems delete, which can only suppress, and which are exempt for a lawful reason. The statute allows exceptions, so legal should decide, and you should record each decision.
Correct: which system is the source of truth, and how do corrections propagate?
Opt out and limit: how does a preference reach the ad tags, the data feeds and the processing for sensitive data?
Test each path with an internal dummy request every quarter, and log the time it took.
What security tasks fall out?
The Attorney General's page centres on rights and notices. For security duties beyond that, ask counsel to point you to the statute and regulations. In practice, the map suggests the usual tasks.
- Access control on systems holding personal data, with periodic review.
- Logging that avoids storing personal information it does not need.
- Retention limits that are enforced by jobs, not by good intentions.
- Vendor review for every recipient on the map.
- A software inventory for the systems that hold the data, so you can answer which components run there.
For that last item, Safeguard can generate SBOMs and scan dependencies, and the free browser scan at gold.safeguard.sh/scan checks up to 100 dependencies.
What are common mistakes?
Treating the privacy notice as a marketing document. It should match the map line by line.
Forgetting backups and logs. They hold personal data and are often missing from the map.
Letting each team add tags and vendors without a gate. The map goes stale in a month.
What to do
- Build the personal information map from systems, not from forms.
- Assign an owner to each system on the map.
- Draw a path for each consumer right and test it with a dummy request.
- Enforce retention in code or jobs, including logs.
- Add a review step for new vendors and tags.
- Compare the privacy notice to the map twice a year.
Quick check
Who decides which deletion exceptions apply?
Counsel should, since the law lists exceptions. Security's role is to make deletion and suppression technically possible and to log each decision.
Do backups matter for a deletion request?
They hold personal data, so they belong on the map. Ask counsel how the company will treat them and document it.
Sources
Last reviewed: 18 October 2026.
