CCPA, CPRA, and the rest of the US state-privacy patchwork.
The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), is the strictest US state privacy law — and the de-facto baseline for 14 other state laws (VCDPA, CPA, CTDPA, UCPA, and rising). GR IT Services maps your data, builds the consumer-rights workflow, drafts the privacy notice, and operates the request-fulfilment process under written SLA.
- 15+US state laws
- 45-dayRequest SLA
- DPA-readyVendor contracts
- Cal-AGInquiry-ready
Nine capabilities for US state-privacy compliance.
Data inventory & mapping
Document where personal information lives, how it flows between systems, which categories are collected, and which third parties receive it. Output: a written data map that survives audits and powers the rest of compliance.
Privacy notice authorship
Draft or update the privacy notice covering CCPA / CPRA-required disclosures: categories collected, sources, purposes, third-party recipients, retention periods, and consumer rights. State-specific overlays added per market.
Consumer-rights request workflow
Operating workflow for the five core CCPA rights — know, delete, correct, opt-out of sale/sharing, limit use of sensitive PI — within the 45-day statutory SLA. Identity verification, request queue, and audit log.
Do-Not-Sell / Opt-Out signal handling
Implement the GPC (Global Privacy Control) signal honour, "Do Not Sell or Share My Personal Information" link, and limit-use-of-sensitive-PI opt-out — required surfaces on your homepage and in your privacy notice.
Vendor & service-provider contracts
Update vendor contracts to include CCPA-compliant data-processing terms: purpose limitations, sub-processor approval, audit rights, deletion-on-termination, breach-notice flow-down. DPA templates supplied.
Risk assessments (CPRA + state laws)
Author the cybersecurity audit and risk assessment that CPRA requires for processing presenting "significant risk to consumers". Same documentation satisfies VCDPA, CPA, CTDPA DPIA requirements.
Security & encryption baselines
Implement "reasonable security" — the standard CCPA requires and the basis of every class-action under §1798.150. Microsoft 365 + Defender + Entra baselines mapped to NIST CSF + CIS Controls v8.
Breach-response programme
Written incident-response plan with California-specific breach-notice workflow (Civ. Code §1798.82 — 5 business days for the AG once 500+ residents affected). State-by-state notice timelines harmonised.
Ongoing operations
Quarterly programme reviews, annual privacy-notice refresh, training programme, vendor-monitoring cadence, AG-inquiry response readiness. Compliance as a sustained capability, not a one-off project.
Four reasons US businesses pick us.
Multi-state law fluency
15 US states now have comprehensive privacy laws, with more advancing through state legislatures. We map all of them to a single control programme so you do not run separate compliance for each.
Microsoft Purview + Defender mapped
CPRA risk-assessment and security obligations map cleanly onto Microsoft Purview (DLP, sensitivity labels, eDiscovery) and Defender. Our typical engagement deploys these once and satisfies CCPA + GLBA + HIPAA overlays.
US delivery, AG-fluent
Familiarity with California AG enforcement style, the California Privacy Protection Agency (CPPA), and the AG offices in Virginia, Colorado, Connecticut. We brief executive teams on what AGs actually ask.
Operating playbook is the deliverable
We do not just "set up the privacy notice". We deliver the operating playbook: request-fulfilment SOPs, ID-verification procedures, training, audit logs. Hand it to your team or AG inquiry, unedited.
Where state-privacy laws bite hardest.
E-commerce & retail
D2C retailers, marketplaces, and brick-and-click chains collecting purchase history, browsing data, and marketing profiles. Cookie-banner and Global Privacy Control compliance is contested ground here.
SaaS & B2B platforms
B2B SaaS companies that process personal information on behalf of customers (service-provider role) — including HR-tech, sales-tech, marketing-tech, and analytics platforms. DPA templates and sub-processor management.
AdTech & MarTech
Ad networks, DSPs, SSPs, identity-resolution platforms, and CDP / data-broker businesses where "sale" / "sharing" definitions apply. Highest CPRA risk segment due to data-broker registration requirements.
Health & wellness apps (non-HIPAA)
Fitness, mental-health, and wellness apps not covered by HIPAA. Often handling sensitive PI under CPRA — health data, biometric data — with elevated obligations.
Fintech & consumer finance
Consumer-finance apps, BNPL, marketplace lenders, neobanks. CCPA layers atop GLBA Safeguards Rule and Reg S-P. We harmonise the obligations into a single control programme.
Real-estate, automotive, telecom
Industries collecting high-volume consumer data with limited prior privacy programmes. CCPA brought these segments under formal regulation for the first time; class-action exposure is rising.
CCPA vs VCDPA vs CPA vs CTDPA — what differs?
| Feature | CCPA / CPRA California | VCDPA Virginia | CPA Colorado | CTDPA Connecticut |
|---|---|---|---|---|
Effective date | Jan 2020 / Jan 2023 | Jan 2023 | Jul 2023 | Jul 2023 |
Applies to (thresholds) | $25m rev OR 100k consumers OR 50% rev from sale | 100k consumers OR 25k + 50% rev from sale | 100k consumers OR 25k + revenue from sale | 100k consumers OR 25k + 25% rev from sale |
Right to know / access | ||||
Right to delete | ||||
Right to correct | Yes (CPRA) | |||
Right to opt-out of sale/sharing | ||||
Universal opt-out signal (GPC) | Required | Required (Jan 2025) | Required | Required |
Private right of action | Yes (data breach only) | |||
Maximum penalty per violation | $7,500 (intentional) | $7,500 | $20,000 | $5,000 |
DPA / risk-assessment required | Yes (CPRA) |
Readiness to operating programme in four phases.
- 1
Data mapping & scoping
3-5 weeks
Document personal information across systems, sources, purposes, and recipients. Identify CCPA scope (revenue / consumer-count thresholds) and CPRA "sensitive PI" categories. Output: data-flow map, scoping memo, business-purposes inventory.
- 2
Programme & notice build
4-6 weeks
Draft the privacy notice, "Do Not Sell or Share" workflow, sensitive-PI limit-use mechanism. Author internal policies. Build the consumer-request intake and fulfilment workflow (identity verification, queue management, audit trail).
- 3
Vendor & contract remediation
6-12 weeks (parallel)
Update vendor contracts with CCPA-compliant data-processing terms. Implement sub-processor approval workflow. Stand up vendor-monitoring cadence. Conduct CPRA risk assessments for high-risk processing.
- 4
Operate & expand
Continuous
Operate the consumer-rights request programme under written SLA. Quarterly programme reviews. Annual privacy-notice refresh and risk-assessment update. Expand to new state laws as they take effect.
“We had 1.8 million California users and zero state-privacy programme. The CPPA opened an inquiry six months in. GR IT pulled the data map together in eight weeks, rebuilt the privacy notice with proper Do-Not-Sell wiring, and stood up the consumer-rights workflow. We resolved the CPPA inquiry with no fine and have run clean since.”
CCPA, CPRA, and US state privacy, frequently asked.
US privacy and security resources.
Cybersecurity audit & compliance services
General-purpose audit pillar covering HIPAA, SOC 2, NIST CSF, ISO 27001, PCI DSS.
Learn moreGLBA compliance services
Gramm-Leach-Bliley Safeguards Rule for financial institutions — typically applied alongside CCPA in fintech.
Learn moreMicrosoft Purview data governance
Microsoft Purview is the Microsoft platform that powers DLP, eDiscovery, and sensitivity-labelling for CCPA "reasonable security".
Learn moreBook a CCPA / CPRA readiness review.
Sixty-minute discovery call with a senior consultant. Output: a written first-cut scoping memo covering CA threshold analysis, applicable state laws, and gap estimate. No obligation.