Having a Privacy Policy Isn’t CCPA-CPRA Compliance.
We help organisations understand their CCPA-CPRA obligations, map how California consumers’ personal information is collected and used, strengthen privacy controls, manage consumer rights and reduce regulatory risk — so privacy becomes an operational capability, not just a policy.
Does CCPA/CPRA apply to you?
CCPA/CPRA applies once you cross a revenue, data-volume, or data-sale threshold — regardless of where your company is based. A few quick questions, one clear answer.
Which best describes your business?
- Sector—
- Threshold met—
- Sale/share activity—
- Sensitive data—
- Existing program—
Most companies don’t fail CCPA/CPRA because they ignore California consumers. They fail because “we have a cookie banner” was never the same as honoring an opt-out.
CCPA/CPRA applies the moment you cross one of three thresholds — revenue, data volume, or data-sale revenue — regardless of where your company is based.
Most companies already have some privacy controls in place. The gap is knowing whether CCPA/CPRA applies, what personal information is being sold or shared, and whether consumer rights and opt-outs actually work across your systems and third parties. That’s where we help: turning CCPA/CPRA requirements into a practical privacy program that your organisation can actually operate and evidence.
A Structured Approach to CCPA/CPRA Readiness.
We begin by assessing your current data practices against CCPA/CPRA’s consumer-rights requirements, identifying gaps in notice, opt-out, and data-sale disclosures, and prioritizing remediation. From implementing technical safeguards to documenting consumer-request workflows, we help you build an environment that is organized, defensible, and ready for regulatory scrutiny.
Everything You Need for CCPA-CPRA Readiness.
Every engagement produces practical, usable deliverables mapped to CCPA/CPRA requirements — from applicability and consumer rights to opt-out mechanisms, data mapping, privacy notices and ongoing compliance monitoring.
CCPA/CPRA Applicability & Gap Assessment
Applicability thresholds, existing privacy practices and CCPA/CPRA control gaps assessed against your actual business and data environment.
Consumer Rights Request Process
Structured workflows for handling access, deletion, correction and opt-out requests within applicable CCPA/CPRA requirements and timelines.
Do Not Sell/Share Mechanism Implementation
Practical opt-out mechanisms implemented and aligned with requirements for the sale or sharing of consumers’ personal information.
Data Inventory & Sale/Share Mapping
Personal information inventories mapped across systems, business processes, vendors and activities involving the sale or sharing of personal information.
Privacy Notice Rewrite
Privacy notices reviewed and rewritten to provide CCPA/CPRA-specific disclosures about collection, use, sale, sharing and consumer rights.
Sensitive Personal Information Controls
Controls and handling practices reviewed for sensitive personal information, including applicable use, disclosure, access and limitation requirements.
Service Provider/Contractor Agreement Review
Service provider and contractor relationships reviewed for CCPA/CPRA obligations, data-handling responsibilities, restrictions and contractual safeguards.
Employee Training
Practical training for employees on consumer-request handling, privacy responsibilities, escalation procedures and CCPA/CPRA obligations.
Ongoing Compliance Monitoring
Continuous monitoring of business growth, processing activities, privacy controls and applicability thresholds so emerging CCPA/CPRA obligations are identified early.
Security work that shows up in the numbers.
Every engagement is measured, not just delivered.
The Right CCPA-CPRA Partner Makes All the Difference.
| Criteria |
// Recommended
BPDoxS
|
// In-house In-house team | // Vendor Typical vendor |
|---|---|---|---|
| CCPA-CPRA Expertise |
Practical expertise across CCPA/CPRA applicability, consumer rights, opt-outs, disclosures and operational privacy controls
|
Strong understanding of the business, but specialist California privacy expertise may depend on available internal resources
|
Specialist privacy firms may provide strong CCPA/CPRA knowledge where California privacy is part of their core service
|
| Applicability & Threshold Assessment |
Assesses revenue, consumer-data volume and sale/share activity to determine whether CCPA/CPRA obligations apply
|
Best visibility into company revenue, data volumes and business operations needed to assess applicability
|
Can assess thresholds when included in scope, but typically depends on information supplied by the client
|
| Consumer Rights & Opt-Outs |
Connects access, deletion, correction and opt-out workflows with the systems and teams responsible for fulfilling requests
|
Direct control over customer systems and internal teams makes ongoing request fulfilment highly manageable
|
Privacy specialists can design consumer-rights workflows and opt-out controls within the agreed engagement scope
|
| Data Inventory & Sale/Share Mapping |
Maps personal information across systems, business processes, vendors and activities involving sale or sharing
|
Strongest access to internal data sources, applications and operational knowledge needed for accurate inventory mapping
|
Can perform focused data-mapping exercises, but visibility is usually limited to the systems and scope defined by the client
|
| Third-Party & Contract Risk |
Reviews service providers, contractors, data-sharing relationships and contractual responsibilities across the privacy ecosystem
|
Strongest knowledge of existing vendors, contracts and operational relationships involving consumer information
|
Typically focuses on its own service or defined review scope rather than the client's complete third-party privacy ecosystem
|
| Ongoing Compliance Readiness |
Monitors business growth, processing changes, sale/share activities and applicability thresholds so emerging CCPA/CPRA gaps are identified early
|
Best positioned to own long-term privacy operations, provided sufficient internal resources and specialist knowledge remain available
|
Recurring support is possible, but a typical vendor cannot own the client's complete privacy posture across changing business activities
|
Independently recognized.
Rated by clients on Clutch · GoodFirms · Sortlist · DesignRush · RightFirms
Questions Worth Asking.
Everything you need to know before becoming CCPA-CPRA-ready with confidence.
CCPA/CPRA can apply to businesses that meet specific applicability thresholds relating to California consumers' personal information, including business revenue, the volume of consumers' information processed, or revenue derived from selling personal information. Applicability is not limited to companies physically located in California. We assess your business model, revenue, data volumes and processing activities to determine whether the law applies and which obligations are relevant.
If your business is subject to the applicable CCPA requirements and sells or shares personal information as defined by the law, consumers may have the right to opt out. Businesses also need to provide an appropriate mechanism for exercising that right and must properly honor valid opt-out requests. We help identify what constitutes sale or sharing in your environment and implement workflows and controls that make the opt-out effective across relevant systems and third parties.
Depending on the circumstances, California consumers have rights including access, deletion, correction, and opting out of the sale or sharing of personal information. The CPRA also provides additional protections concerning sensitive personal information. Organisations need practical processes for receiving, verifying, tracking and responding to applicable requests within the required timelines. We help build structured workflows that connect consumer requests to the systems and teams responsible for fulfilling them.
CCPA/CPRA uses specific definitions of "selling" and "sharing" that can cover more than a traditional exchange of customer data for money. Certain disclosures to advertising, analytics or other third parties may need to be assessed against these definitions. We map how personal information moves through your website, applications, advertising platforms, analytics tools, vendors and other third parties to identify relevant sale or sharing activities and the controls required for them.
Businesses subject to CCPA requirements need to provide specific disclosures about their collection and use of personal information, including information about categories of personal information collected, purposes of use and applicable consumer rights. The notice should accurately reflect the organisation's actual practices rather than simply copying a generic privacy template. We help review and rewrite privacy notices so the required CCPA/CPRA disclosures match your real data practices.
No. A privacy policy and cookie banner are only parts of a CCPA/CPRA compliance program. Organisations also need to understand applicability thresholds, map personal information, identify sale and sharing activities, provide and honor applicable consumer rights, manage service providers and contractors, address sensitive personal information requirements and maintain appropriate records and processes. We help turn these requirements into documented, operational controls that your teams can actually follow and evidence.
Know what data you collect and share. Know what needs to change.
Start with a practical assessment of your CCPA-CPRA applicability, personal information flows and existing privacy controls — then get a clear roadmap to close compliance gaps, strengthen consumer rights processes and build a privacy program your organisation can actually operate.
