How to implement CCPA and CPRA yourself, step by step

To implement CCPA and CPRA yourself, work in this order: confirm you are covered, map your personal information, publish accurate notices, build a request process with deadlines, fix vendor contracts, honor opt out signals, train staff, and keep evidence. There is no certification, so your records are what you show a regulator.

Step 1: Confirm coverage and map the data

Check the three thresholds on the California Attorney General's page: gross revenue over $25 million, 100,000 or more consumers or households, or 50 percent of revenue from selling or sharing data. Then build a data map listing each system, the categories collected, the source, the purpose, the retention period and the recipients. Section 1798.100 requires you to tell people the categories, purposes and retention length at or before collection, so the map feeds every notice you write.

Step 2: Publish the notices

You need a notice at collection and a privacy policy. The notice at collection lists the categories of personal information and sensitive personal information, the purposes, whether the data is sold or shared, and the retention period or the criteria used to set it. The privacy policy describes consumer rights and how to use them. Put both where people actually meet your data collection, not only in a footer.

If you sell or share personal information, add a clear "Do Not Sell or Share My Personal Information" link. If you use or disclose sensitive personal information beyond permitted purposes, offer the right to limit it.

Step 3: Build the request process

Consumers can ask to know, delete, correct, opt out, and limit use of sensitive data. The AG page gives these deadlines: respond to requests to know, delete and correct within 45 calendar days, extendable once by another 45 days with notice, and act on opt outs as soon as feasible and no later than 15 business days. Provide at least two request methods, with a toll free number and a website route, except that an exclusively online business needs only an email address.

Write the workflow: intake, identity check proportionate to the risk, search across the systems on your map, decision, response, and a log. Test it with a dummy request before launch. Ask engineering how deletion works in backups and analytics stores, and write the answer down.

Step 4: Fix vendor contracts

Sort recipients into service providers, contractors and third parties. Service providers need a written contract that restricts use of the data to the contracted purpose. Third parties that receive data for their own purposes make that disclosure a sale or share unless an exception applies. Pull each contract, add missing terms, and record the date.

Step 5: Honor opt out preference signals

The AG page notes the right to opt out can be exercised through a user enabled global privacy control such as GPC. Ask your web team to test that your site detects the signal and stops the relevant tags. Capture a dated test as evidence.

Step 6: Handle minors and sensitive data

Selling data of a consumer known to be under 16 requires opt in consent, with a parent or guardian consent for under 13. If you hold sensitive personal information such as precise geolocation, health data or account log in details with access codes, document why and limit its use.

Step 7: Train staff and keep evidence

Staff who handle requests must know the deadlines and the process. Keep: the scoping memo, data map, notice versions with dates, the request log, vendor contracts, opt out test records, training sign in sheets and a review calendar. Review notices at least yearly and whenever you add a data use.

What to do

1. Run the three threshold tests and record the answer.
2. Build and date the data map.
3. Publish the notice at collection and the privacy policy.
4. Build the request workflow and test it end to end.
5. Review every vendor contract and fix the gaps.
6. Test opt out signals on the live site.
7. Train the people who will answer requests.
8. Set a yearly review and a trigger list for off cycle updates.

Quick check

How Safeguard helps automate this

Most of the engineering work in this plan is finding where data and third party code live. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between reviews. Technical evidence comes from your actual code and dependencies using scans, SBOMs and reachability. The agent can open tested fix pull requests for vulnerable dependencies and other findings, but it is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence and keep it ready; legal advice and any regulator decision remain outside it. Book a call.

Open the framework mapping demo

Sources

• California Attorney General, CCPA page
• CCPA statute text, California Privacy Protection Agency

Last reviewed: 18 October 2026.