The California Consumer Privacy Act, as changed by the California Privacy Rights Act, gives California residents rights to know, delete, correct, and to opt out of the sale and sharing of their personal information. It puts duties of notice, purpose limits, contracts and security on businesses, and is enforced by the California Privacy Protection Agency and the Attorney General. This list gathers 39 provisions and rules.
Free account needed to download. You come straight back to the file.
Who it is for. For-profit businesses that do business in California and meet the size or data-volume tests, including Indian exporters and service providers that handle the data of California residents as a business or as a service provider.
What this list covers. California Civil Code 1798.100 to 1798.199.100 as amended by the CPRA (effective 1 January 2023), with the CPPA regulations approved 22 September 2025 and effective 1 January 2026: 39 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| 1798.140(d) | Who counts as a business | A for-profit doing business in California is covered if it meets any one test: revenue over US$25 million (US$26,625,000 from 1 January 2025, adjusted for inflation), 100,000 consumers or households, or half its revenue from selling or sharing data. |
| 1798.145 | Exemptions and limits | Work out which exemptions apply, for example health, credit and bank data covered by other federal or state laws. The earlier carve-outs for employee and business-contact data ended on 1 January 2023. |
| 1798.192 | No waiving of rights | Do not rely on terms of service or other contract terms that make a consumer give up these rights or remedies. Such terms are void. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.100(a) | Notice at collection | At or before collection, tell people what categories of personal and sensitive data you collect, why, whether you sell or share them and how long you keep each. A third party that collects data must give this notice too, on its homepage and on site. |
| 1798.100(c) | Minimisation and purpose limits | Keep collection, use, retention and sharing reasonably necessary and proportionate to the purposes you disclosed, or to compatible ones. Do not process data in ways that do not fit those purposes. |
| 1798.130(a)(5) | Online privacy policy | Publish a privacy policy describing the consumer rights, how to use them, and the categories of data collected, sold, shared or disclosed, and update it at least every 12 months. |
| 1798.140(h) | Valid consent and dark patterns | Where you need consent, get a clear, specific, informed and affirmative agreement. Broad terms of use, closing a pop-up, or choices steered by manipulative interface design do not count. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.105 | Right to delete | Delete a consumer's personal information on a verified request, and tell your service providers, contractors and the third parties you sold or shared it with to delete it too, unless an exception applies. |
| 1798.106 | Right to correct | Correct inaccurate personal information on a verified request, using commercially reasonable efforts, and tell consumers that this right exists. |
| 1798.110 | Right to know what you collect | On a verified request, disclose the categories and specific pieces of personal information you hold, their sources, the purposes of collection and the categories of third parties receiving them. |
| 1798.115 | Right to know what you sell or disclose | On request, say which categories of personal information you sold or shared and which you disclosed for a business purpose, and to which categories of recipients. |
| 1798.120 | Right to opt out of sale and sharing | Let consumers tell you at any time to stop selling or sharing their data, tell them about the right, and honour the choice, including in an acquisition. |
| 1798.120(c) | Under-16 opt-in | Do not sell or share the data of a consumer you know is under 16 without opt-in authorisation: their own for ages 13 to 15, a parent's or guardian's for under 13. |
| 1798.121 | Right to limit use of sensitive data | Let consumers restrict your use of their sensitive personal information to what is needed to provide the service they asked for and a short list of permitted purposes. |
| 1798.125 | Non-discrimination and incentives | Do not deny service, charge different prices or retaliate against someone for using their rights. Offer loyalty or data-value incentives only with opt-in consent and clear terms. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.130(a)(1) | Ways to make a request | Offer at least two ways to submit requests, including a toll-free number. An online-only business with a direct consumer relationship may offer an email address instead. |
| 1798.130(a)(2) | 45-day response | Respond to verified requests within 45 days, free of charge. Extend once by 45 more days if you tell the consumer in time. You need not answer the same person's access requests more than twice a year. |
| 1798.130(a)(6) | Training staff | Make sure everyone who handles privacy questions or requests knows the requirements and how to direct consumers to exercise their rights. |
| 1798.135(a) | Opt-out links | If you sell or share data, or use sensitive data beyond permitted purposes, put clear homepage links to opt out and to limit use, or one combined link, or honour opt-out signals instead. |
| 1798.135(b)(1) | Opt-out preference signals | Treat a browser or device opt-out signal, such as Global Privacy Control, as a valid request to opt out of sale and sharing, unless the consumer has separately agreed otherwise. |
| 1798.135(c) | Handling opt-outs | Do not demand an account or extra data to opt out, use the opt-out details only to act on it, and wait 12 months before asking the consumer to opt back in. Accept requests by authorised agents. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.100(d) | Contracts with recipients | When you sell, share or disclose personal information to a third party, service provider or contractor, sign a contract that limits use to stated purposes, requires equal privacy protection and lets you check and stop misuse. |
| 1798.140(ag) | Acting as a service provider | If you process data for a business, do so only for the purposes in the contract, do not sell, share or combine it for other uses, help the business answer requests, and tell it if you can no longer comply. |
| 1798.115(d) | Third parties may not resell | If you receive personal information as a third party, do not sell or share it onward unless the consumer got explicit notice and the chance to opt out. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.100(e) | Reasonable security | Keep reasonable security procedures suited to the nature of the personal information you collect, to guard against unauthorised access, destruction, use, change or disclosure. |
| 1798.81.5 | Security duty and contracts | If you hold personal information about Californians, keep reasonable security for it and require unaffiliated recipients to do the same by contract. |
| 1798.82 | Breach notice to individuals | Notify affected California residents of a breach of computerised data within 30 days of discovery, in the plain-language format the law sets, and send the Attorney General a sample when over 500 residents are affected. |
| 1798.150 | Private right of action for breaches | Expect consumers to sue for statutory damages (US$100 to US$750 per incident, adjusted for inflation) if unencrypted data is stolen through your failure to keep reasonable security, after a 30-day cure notice. |
| Ref | Control | What it requires |
|---|---|---|
| 1798.185(a)(14)(A) | Cybersecurity audits | If your processing presents significant security risk, have an independent cybersecurity audit and certify it to the Agency, from 1 April 2028 for larger businesses, 2029 for mid-sized and 2030 for the rest. |
| 1798.185(a)(14)(B) | Risk assessments | Assess the risks of processing the rules treat as high risk, from 1 January 2026, and by 1 April 2028 file an attestation and summary with the Agency. |
| 1798.185(a)(15) | Automated decision-making technology | If you use automated tools for significant decisions about people, let them opt out and get access to information about how it is used. Compliance is required from 1 January 2027. |
| Ref | Control | What it requires |
|---|---|---|
| 11 CCR 7010-7016 | Required disclosures | Follow the Agency's rules on the form and content of the notice at collection, notice of right to opt out, privacy policy and notice of financial incentive, including accessibility. |
| 11 CCR 7020-7031 | Rules for handling requests | Follow the regulations for how to receive, process and answer each kind of request, including requests to know, delete, correct, opt out and limit, and opt-out preference signals. |
| 11 CCR 7060-7063 | Verifying requests | Verify requests to know, delete and correct to a degree that fits the risk, use the verification data only for that, and do not make people create an account. |
| 11 CCR 7100-7102 | Training and record-keeping | Train people who handle requests, and keep records of the consumer requests you receive and how you responded to them. |
| 1798.199.10 | The California Privacy Protection Agency | Know that the Agency, run by a five-member board, administers and enforces the law. It writes the rules, gives guidance, and runs audits and investigations. |
| 1798.199.55 | Administrative enforcement | Expect the Agency to act on sworn complaints or its own findings: after a hearing it can order you to stop violating the law and impose fines. It may sometimes allow time to cure first. |
| 1798.155 | Fines per violation | The maximum fine is US$2,500 per violation, and US$7,500 for an intentional one or one involving a consumer known to be under 16. Both are inflation-adjusted: US$2,663 and US$7,988 from 1 January 2025. |
| 1798.199.90 | Attorney General actions | Expect the Attorney General to be able to sue for an injunction and civil penalties at the same levels, with good-faith cooperation counted in your favour. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
It can. There is no test based on where you are based. If you do business in California and meet one of the thresholds, or you process data for a business that does as its service provider, the contract and the law reach you.
A for-profit doing business in California is covered if it has annual revenue above the revenue threshold, handles personal information of 100,000 or more consumers or households, or earns half or more of its revenue from selling or sharing personal information. Check the current inflation-adjusted revenue figure.
45 days for requests to know, delete and correct, with one extension of 45 more days if you tell the consumer in the first period. Opt-out requests must be acted on faster, as soon as feasible.
Selling is disclosing data for money or other valuable consideration. Sharing is disclosing it for cross-context behavioural advertising, with or without payment. Consumers can opt out of both.
No. It lists the provisions that carry duties or rights, in plain words, so you can plan and track. The statute, the regulations and Agency guidance are the authority, and the rules for risk assessments, audits and automated decisions have phased dates.