A business that knows or should know that in a calendar year it buys, receives, sells or shares, or otherwise provides for commercial ends, the data of 10 million or more consumers must compile, for the previous calendar year, how many requests to delete, correct, know, access ADMT, opt out of sale or sharing, limit, and opt out of ADMT it received, complied with in whole or part, and denied, plus the median or mean days to respond, and publish them by 1 July each year in or linked from its privacy policy. It may report all individuals' requests if it says so and gives the consumer-only figures to the Attorney General on request.
CCPA/CPRA CCR 7102 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CCPA/CPRA your existing evidence covers. Hold GDPR and 17 of 89 CCPA/CPRA controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the GDPR pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.