CCPA/CPRA

United States - California

v2023

11 domains

31 controls

California Consumer Privacy Act / California Privacy Rights Act

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Business Obligations

10 controls

Controls in the Business Obligations domain of CCPA/CPRA — 10 controls
Code	Title	Description
CCR §7012	Notice at Collection Drafting Requirements	The notice at collection must (a) identify the categories of PI to be collected, (b) identify the purposes for which cat...
CCR §7025	Opt-Out Preference Signal Configuration	Opt-out preference signals must be processed by businesses that sell or share PI. The signal must be in a format commonl...
§1798.100	General Duties of Businesses that Collect Personal Information	Businesses collecting personal information about consumers must inform consumers, at or before the point of collection,...
§1798.130(a)(3)	Privacy Policy Content Requirements	Businesses must include in their online privacy policy or California-specific description: a description of consumer rig...
§1798.130(a)(5)(C)	Notice at Collection	At or before the point of collection of PI, a business shall inform consumers of the categories of PI to be collected an...
§1798.135(a)	Do Not Sell or Share My Personal Information Link	A business that sells or shares PI shall provide a clear and conspicuous link on its internet homepage titled Do Not Sel...
§1798.135(b)	Opt-Out Preference Signals (Global Privacy Control)	A business that sells or shares PI shall process an opt-out preference signal (such as Global Privacy Control) sent with...
§1798.140	Threshold for Applicability and Key Definitions	A business is subject to CCPA/CPRA if it is a for-profit entity doing business in California that collects PI of Califor...
§1798.145	Exemptions and Permitted Activities	CCPA/CPRA obligations do not restrict compliance with federal/state/local law, cooperation with law enforcement, exercis...
§1798.185(a)(15)	Risk Assessments for High-Risk Processing	Businesses whose processing of PI presents significant risk to consumers privacy or security must submit risk assessment...

CCPA/CPRA: Accountability & Compliance

0 controls

Demonstration of compliance and accountability (CCPA/CPRA)

CCPA/CPRA: Data Collection & Consent

0 controls

Requirements for lawful collection and consent management (CCPA/CPRA)

CCPA/CPRA: Data Governance

0 controls

Organizational governance of personal data processing (CCPA/CPRA)

CCPA/CPRA: Data Security

0 controls

Technical and organizational security measures (CCPA/CPRA)

CCPA/CPRA: Data Subject Rights

0 controls

Individual rights regarding their personal data (CCPA/CPRA)

Consumer Rights

9 controls

Controls in the Consumer Rights domain of CCPA/CPRA — 9 controls
Code	Title	Description
CCR §7026	Requests to Opt-Out of Sale/Sharing Handling	A business shall act upon a request to opt out as soon as feasibly possible, but no later than 15 business days from the...
§1798.105	Right to Delete Personal Information	Consumers have the right to request deletion of PI a business has collected from them. Upon receipt of a verifiable requ...
§1798.106	Right to Correct Inaccurate Personal Information	Consumers have the right to request a business that maintains inaccurate PI about them to correct that inaccurate PI, ta...
§1798.110	Right to Know Categories and Specific Pieces of Personal Information Collected	Consumers have the right to request that a business that collects PI about the consumer disclose: categories of PI colle...
§1798.115	Right to Know Personal Information Sold or Shared and Recipients	Consumers have the right to request a business that sells or shares PI, or discloses it for a business purpose, to discl...
§1798.120	Right to Opt Out of Sale or Sharing of Personal Information	Consumers have the right, at any time, to direct a business that sells or shares PI about the consumer to third parties...
§1798.125	Non-Discrimination for Exercise of Rights	Businesses shall not discriminate against a consumer for exercising rights, including by denying goods or services, char...
§1798.135(c)	Authorized Agent Requests	A consumer may use an authorized agent to submit requests on the consumer's behalf. A business may require the agent to...
§1798.185(a)(16)	Automated Decisionmaking Technology Access and Opt-Out	Consumers have rights regarding businesses use of automated decisionmaking technology (ADMT), including profiling. Busin...

Enforcement

3 controls

Controls in the Enforcement domain of CCPA/CPRA — 3 controls
Code	Title	Description
CCR §7301-7304	CPPA Audit and Investigation Cooperation	The California Privacy Protection Agency may audit a business to ensure compliance. A business subject to audit must pro...
§1798.150	Private Right of Action for Data Breaches	A consumer whose nonencrypted and nonredacted PI (or email address with password/security question allowing account acce...
§1798.155	Administrative Enforcement and Civil Penalties	A business, service provider, contractor, or other person who violates the Act shall be liable for an administrative fin...

Privacy Operations

5 controls

Controls in the Privacy Operations domain of CCPA/CPRA — 5 controls
Code	Title	Description
CCR §7060	Consumer Identity Verification	Businesses must establish, document, and comply with reasonable methods to verify the consumer is the person about whom...
CCR §7100-7102	Recordkeeping Requirements	Businesses must maintain records of consumer requests and the businesses response for at least 24 months. The records mu...
§1798.130(a)(1)	Designated Methods for Submitting Consumer Requests	Businesses shall make available designated methods for submitting requests, including, at minimum, a toll-free telephone...
§1798.130(a)(2)	45-Day Response Window and Identity Verification	Businesses must disclose and deliver requested information to the consumer free of charge within 45 days of receiving a...
§1798.130(c)	Annual Metrics Disclosure (Large Businesses)	A business that knows or reasonably should know that it buys, sells, shares, or receives the PI of 10,000,000 or more co...

Sensitive PI

2 controls

Controls in the Sensitive PI domain of CCPA/CPRA — 2 controls
Code	Title	Description
CCR §7027	Requests to Limit Use of Sensitive PI Handling	Once a consumer requests to limit, the business shall not use or disclose the sensitive PI for any purpose other than th...
§1798.121	Right to Limit Use and Disclosure of Sensitive Personal Information	Consumers have the right to direct a business that collects sensitive PI to limit its use to that necessary to perform s...

Service Provider

2 controls

Controls in the Service Provider domain of CCPA/CPRA — 2 controls
Code	Title	Description
CCR §7050	Service Provider and Contractor Obligations	A service provider or contractor shall only process PI on behalf of a business for a business purpose specified in the w...
§1798.100(d)	Contractual Requirements for Third Parties, Service Providers, and Contractors	A business that collects PI and sells/shares it with a third party or discloses it to a service provider or contractor m...

Your Compliance Coverage

If you comply with CCPA/CPRA, you already cover:

Connecticut Data Privacy Act (CTDPA)

19%

6 controls mapped

Compare →

Colorado Privacy Act

19%

6 controls mapped

Compare →

China Personal Information Protection Law (PIPL)

19%

6 controls mapped

Compare →

+ 3 more: Delaware Online Privacy and Protection Act (proposed) (13%), COPPA (13%)

See all 6 mapped frameworks ↓

Maps to 6 other frameworks

31 total controls

Connecticut Data Privacy Act (CTDPA)

6 source controls mapped|9 target controls covered

19%

Colorado Privacy Act

6 source controls mapped|9 target controls covered

19%

China Personal Information Protection Law (PIPL)

6 source controls mapped|7 target controls covered

19%

Delaware Online Privacy and Protection Act (proposed)

4 source controls mapped|3 target controls covered

13%

COPPA

4 source controls mapped|3 target controls covered

13%

California IoT Security Law

1 source controls mapped|1 target controls covered

Compare CCPA/CPRA with Connecticut Data Privacy Act (CTDPA)

Frequently Asked Questions

What is CCPA/CPRA?

CCPA/CPRA is a compliance framework from United States - California with 11 domains and 31 controls. California Consumer Privacy Act / California Privacy Rights Act It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CCPA/CPRA have?

CCPA/CPRA has 31 controls organised across 11 domains. The largest domains are Business Obligations (10 controls), Consumer Rights (9 controls), Privacy Operations (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CCPA/CPRA map to?

CCPA/CPRA maps to 6 other compliance frameworks. The top mapping partners are Connecticut Data Privacy Act (CTDPA) (19% coverage), Colorado Privacy Act (19% coverage), China Personal Information Protection Law (PIPL) (19% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CCPA/CPRA compliance?

Start your CCPA/CPRA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CCPA/CPRA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 723 frameworks.

Get Started Free →

Free forever — no credit card required