CCPA/CPRA

United States - California

v2023

6 domains

32 controls

California Consumer Privacy Act / California Privacy Rights Act

Verified

CCPA/CPRA is a compliance framework from United States - California with 6 domains and 32 controls that map to 12 other frameworks. The largest domains are Business Obligations (11 controls), Consumer Rights (9 controls), Privacy Operations (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Business Obligations

11 controls

Controls in the Business Obligations domain of CCPA/CPRA — 9 controls
Code	Title	Description
CCR §7012	Notice at Collection Drafting Requirements	The notice at collection must (a) identify the categories of PI to be collected, (b) identify the purposes for which cat...
CCR §7025	Opt-Out Preference Signal Configuration	Opt-out preference signals must be processed by businesses that sell or share PI. The signal must be in a format commonl...
ccpa-cpra::Sec.1798.100(c)	Data Minimisation, Necessity and Proportionality	A business's collection, use, retention and sharing of a consumer's personal information must be reasonably necessary an...
§1798.100	General Duties of Businesses that Collect Personal Information	Businesses collecting personal information about consumers must inform consumers, at or before the point of collection,...
§1798.130(a)(3)	Privacy Policy Content Requirements	Businesses must include in their online privacy policy or California-specific description: a description of consumer rig...
§1798.130(a)(5)(C)	Notice at Collection	At or before the point of collection of PI, a business shall inform consumers of the categories of PI to be collected an...
§1798.135(a)	Do Not Sell or Share My Personal Information Link	A business that sells or shares PI shall provide a clear and conspicuous link on its internet homepage titled Do Not Sel...
§1798.135(b)	Opt-Out Preference Signals (Global Privacy Control)	A business that sells or shares PI shall process an opt-out preference signal (such as Global Privacy Control) sent with...
§1798.185(a)(15)	Risk Assessments for High-Risk Processing	Businesses whose processing of PI presents significant risk to consumers privacy or security must submit risk assessment...

Consumer Rights

9 controls

Controls in the Consumer Rights domain of CCPA/CPRA — 9 controls
Code	Title	Description
CCR §7026	Requests to Opt-Out of Sale/Sharing Handling	A business shall act upon a request to opt out as soon as feasibly possible, but no later than 15 business days from the...
§1798.105	Right to Delete Personal Information	Consumers have the right to request deletion of PI a business has collected from them. Upon receipt of a verifiable requ...
§1798.106	Right to Correct Inaccurate Personal Information	Consumers have the right to request a business that maintains inaccurate PI about them to correct that inaccurate PI, ta...
§1798.110	Right to Know Categories and Specific Pieces of Personal Information Collected	Consumers have the right to request that a business that collects PI about the consumer disclose: categories of PI colle...
§1798.115	Right to Know Personal Information Sold or Shared and Recipients	Consumers have the right to request a business that sells or shares PI, or discloses it for a business purpose, to discl...
§1798.120	Right to Opt Out of Sale or Sharing of Personal Information	Consumers have the right, at any time, to direct a business that sells or shares PI about the consumer to third parties...
§1798.125	Non-Discrimination for Exercise of Rights	Businesses shall not discriminate against a consumer for exercising rights, including by denying goods or services, char...
§1798.135(c)	Authorized Agent Requests	A consumer may use an authorized agent to submit requests on the consumer's behalf. A business may require the agent to...
§1798.185(a)(16)	Automated Decisionmaking Technology Access and Opt-Out	Consumers have rights regarding businesses use of automated decisionmaking technology (ADMT), including profiling. Busin...

Enforcement

3 controls

Controls in the Enforcement domain of CCPA/CPRA — 3 controls
Code	Title	Description
CCR §7301-7304	CPPA Audit and Investigation Cooperation	The California Privacy Protection Agency may audit a business to ensure compliance. A business subject to audit must pro...
§1798.150	Private Right of Action for Data Breaches	A consumer whose nonencrypted and nonredacted PI (or email address with password/security question allowing account acce...
§1798.155	Administrative Enforcement and Civil Penalties	A business, service provider, contractor, or other person who violates the Act shall be liable for an administrative fin...

Privacy Operations

5 controls

Controls in the Privacy Operations domain of CCPA/CPRA — 5 controls
Code	Title	Description
CCR §7060	Consumer Identity Verification	Businesses must establish, document, and comply with reasonable methods to verify the consumer is the person about whom...
CCR §7100-7102	Recordkeeping Requirements	Businesses must maintain records of consumer requests and the businesses response for at least 24 months. The records mu...
§1798.130(a)(1)	Designated Methods for Submitting Consumer Requests	Businesses shall make available designated methods for submitting requests, including, at minimum, a toll-free telephone...
§1798.130(a)(2)	45-Day Response Window and Identity Verification	Businesses must disclose and deliver requested information to the consumer free of charge within 45 days of receiving a...
§1798.130(c)	Annual Metrics Disclosure (Large Businesses)	A business that knows or reasonably should know that it buys, sells, shares, or receives the PI of 10,000,000 or more co...

Sensitive PI

2 controls

Controls in the Sensitive PI domain of CCPA/CPRA — 2 controls
Code	Title	Description
CCR §7027	Requests to Limit Use of Sensitive PI Handling	Once a consumer requests to limit, the business shall not use or disclose the sensitive PI for any purpose other than th...
§1798.121	Right to Limit Use and Disclosure of Sensitive Personal Information	Consumers have the right to direct a business that collects sensitive PI to limit its use to that necessary to perform s...

Service Provider

2 controls

Controls in the Service Provider domain of CCPA/CPRA — 2 controls
Code	Title	Description
CCR §7050	Service Provider and Contractor Obligations	A service provider or contractor shall only process PI on behalf of a business for a business purpose specified in the w...
§1798.100(d)	Contractual Requirements for Third Parties, Service Providers, and Contractors	A business that collects PI and sells/shares it with a third party or discloses it to a service provider or contractor m...

Your Compliance Coverage

If you comply with CCPA/CPRA, you already cover:

GDPR

90%

27 controls mapped

Compare →

APEC Cross-Border Privacy Rules (CBPR) System

80%

24 controls mapped

Compare →

Australian Privacy Principles (APPs)

70%

21 controls mapped

Compare →

+ 9 more: ISO 27701:2019 (70%), APPI (67%)

See all 12 mapped frameworks ↓

Maps to 12 other frameworks

30 total controls

GDPR

27 source controls mapped|25 target controls covered

90%

APEC Cross-Border Privacy Rules (CBPR) System

24 source controls mapped|40 target controls covered

80%

Australian Privacy Principles (APPs)

21 source controls mapped|12 target controls covered

70%

ISO 27701:2019

21 source controls mapped|31 target controls covered

70%

APPI

20 source controls mapped|21 target controls covered

67%

SOC 2

16 source controls mapped|17 target controls covered

53%

Connecticut Data Privacy Act (CTDPA)

5 source controls mapped|6 target controls covered

17%

Colorado Privacy Act

5 source controls mapped|5 target controls covered

17%

China Personal Information Protection Law (PIPL)

5 source controls mapped|6 target controls covered

17%

Delaware Online Privacy and Protection Act (proposed)

4 source controls mapped|3 target controls covered

13%

COPPA

4 source controls mapped|3 target controls covered

13%

California IoT Security Law

1 source controls mapped|1 target controls covered

Compare CCPA/CPRA with GDPR

What is CCPA/CPRA and who does it apply to?

CCPA/CPRA is a compliance framework from United States - California with 6 domains and 32 controls. California Consumer Privacy Act / California Privacy Rights Act It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does CCPA/CPRA actually require?

CCPA/CPRA has 32 controls organised across 6 domains. The largest domains are Business Obligations (11 controls), Consumer Rights (9 controls), Privacy Operations (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of CCPA/CPRA do I already cover?

CCPA/CPRA maps to 12 other compliance frameworks. The top mapping partners are GDPR (90% coverage), APEC Cross-Border Privacy Rules (CBPR) System (80% coverage), Australian Privacy Principles (APPs) (70% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement CCPA/CPRA?

Start your CCPA/CPRA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CCPA/CPRA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 32 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required