Key Takeaways
| Point |
Summary |
| Annual review |
Privacy policy updates required at least yearly |
| Request handling |
Continuous process for consumer rights requests |
| Regulatory monitoring |
New regulations and guidance require adaptation |
| Vendor management |
Ongoing oversight of service provider compliance |
| Training |
Regular staff education on CCPA requirements |
Quick Answer: Maintaining CCPA compliance requires annual privacy policy reviews, continuous consumer rights request handling, monitoring of regulatory changes, vendor compliance oversight, staff training, and documentation of compliance activities.
Annual Compliance Activities
Privacy Policy Review
For detailed policy requirements, see privacy policy requirements.
| Activity |
Frequency |
Details |
| Content review |
At least annually |
Verify accuracy of disclosures |
| Categories update |
As needed |
Reflect actual collection practices |
| Rights description |
As regulations change |
Update for new requirements |
| Contact information |
As needed |
Ensure methods work |
| "Last Updated" date |
With each revision |
Document revision date |
Data Inventory Update
| Activity |
Frequency |
Details |
| New data sources |
As added |
Document new collection |
| System changes |
As implemented |
Update data mapping |
| Vendor changes |
As relationships change |
Update service provider list |
| Retention review |
Annually |
Verify retention periods |
Threshold Monitoring
| Metric |
Review Frequency |
Action if Changed |
| Annual revenue |
Annually |
Reassess applicability |
| California consumers |
Quarterly |
Track toward/away from threshold |
| Data revenue percentage |
Annually |
Reassess if approaching 50% |
Continuous Operations
Consumer Request Handling
For detailed consumer rights guidance, see consumer rights explained.
| Process |
Requirement |
| Request intake |
Monitor all intake channels |
| Verification |
Apply consistent verification |
| Response tracking |
Meet 45-day deadline |
| Extension management |
Notify and track extensions |
| Record keeping |
Maintain 24-month records |
Request Metrics (Large Businesses)
Businesses that buy, receive, sell, or share PI of 10 million+ consumers must publish annually:
| Metric |
Details |
| Requests to know |
Number received, fulfilled, denied |
| Requests to delete |
Number received, fulfilled, denied |
| Requests to opt-out |
Number received, complied |
| Response times |
Average days to respond |
Opt-Out Maintenance
| Activity |
Frequency |
Details |
| Link verification |
Monthly |
Confirm links work |
| GPC testing |
Quarterly |
Verify signal detection |
| Advertising configuration |
As platforms change |
Maintain opt-out effectiveness |
| Re-authorization tracking |
Ongoing |
12-month waiting period |
Regulatory Monitoring
CPPA Activity
| Monitor |
Source |
Frequency |
| New regulations |
cppa.ca.gov |
Ongoing |
| Guidance |
CPPA announcements |
Ongoing |
| Enforcement actions |
CPPA press releases |
Monthly |
| Threshold adjustments |
CPI updates |
Every 2 years |
2026 Regulations
New requirements effective January 1, 2026:
| Requirement |
Action Needed |
| Cybersecurity audits |
Assess applicability, plan audits |
| Risk assessments |
ADMT processing assessments |
| Consumer ADMT rights |
Implement access and opt-out |
Attorney General Activity
| Monitor |
Source |
Frequency |
| Enforcement actions |
oag.ca.gov |
Monthly |
| Guidance |
AG advisories |
As issued |
| Investigations |
News, industry sources |
Ongoing |
Vendor Management
For detailed contract requirements, see service provider requirements.
Ongoing Oversight
| Activity |
Frequency |
Details |
| Contract review |
Annually |
Verify CCPA terms current |
| New vendor onboarding |
As added |
Include CCPA terms |
| Subprocessor monitoring |
Ongoing |
Track changes |
| Compliance verification |
Annually |
Questionnaires, attestations |
Service Provider Communication
| Communication |
Timing |
Purpose |
| Deletion instructions |
Per request |
Consumer deletion requests |
| Correction instructions |
Per request |
Consumer correction requests |
| Opt-out notifications |
As received |
Consumer opt-out preferences |
| Contract updates |
As regulations change |
Maintain compliant terms |
Vendor Classification Review
| Trigger |
Action |
| New vendor relationship |
Classify as SP/contractor/third party |
| Relationship change |
Reclassify if role changes |
| Contract renewal |
Verify classification remains accurate |
Staff Training
Training Schedule
| Audience |
Frequency |
Topics |
| All staff |
Annual |
Privacy awareness basics |
| Customer service |
Quarterly |
Request handling |
| Marketing |
Quarterly |
Opt-out, advertising compliance |
| IT/Engineering |
Annual |
Technical requirements |
| Legal/Compliance |
Ongoing |
Regulatory updates |
Training Content Updates
| Trigger |
Training Update |
| New regulations |
Add new requirements |
| Enforcement actions |
Learn from others' violations |
| Process changes |
Reflect new procedures |
| New hires |
Onboarding includes CCPA |
Documentation and Records
Required Records
| Record Type |
Retention |
Details |
| Consumer requests |
24 months |
Requests, responses, timing |
| Privacy policy versions |
Indefinite |
Archive each version |
| Training records |
3+ years |
Who, what, when |
| Vendor contracts |
Life of relationship + 6 years |
Include amendments |
| Consent records |
Life of relationship + 6 years |
Opt-ins for SPI, incentives |
Compliance Evidence
| Evidence |
Purpose |
| Policy review logs |
Demonstrate annual review |
| Request metrics |
Show process functioning |
| Training completion |
Prove staff educated |
| Audit reports |
Third-party verification |
| Security assessments |
Reasonable security evidence |
Responding to Changes
Business Changes
| Change |
Action |
| New product/service |
Privacy impact assessment |
| New data collection |
Update notices and inventory |
| New vendor |
CCPA contract terms |
| Acquisition |
Inherit compliance obligations |
| Divestiture |
Ensure data handling addressed |
| Revenue growth |
Monitor threshold |
Regulatory Changes
| Change |
Action |
| New CPPA regulations |
Gap analysis, implementation plan |
| Enforcement guidance |
Review practices against guidance |
| Penalty adjustments |
Update risk assessments |
| New state laws |
Multi-state compliance review |
Incident Response
| Incident |
Action |
| Data breach |
Follow breach response plan |
| Consumer complaint |
Investigate and respond |
| Regulator inquiry |
Engage legal, respond promptly |
| Third-party violation |
Enforce contract terms |
Compliance Calendar
Monthly
Quarterly
Annually
As Needed
Common Maintenance Failures
| Failure |
Consequence |
| Stale privacy policy |
Inaccurate disclosures, violations |
| Broken opt-out link |
Enforcement risk |
| GPC not working |
Opt-out violations |
| Untrained staff |
Improper request handling |
| Outdated vendor contracts |
Service provider violations |
| No threshold monitoring |
Missed applicability |
Continuous Improvement
Assessment Approach
| Assessment |
Frequency |
Method |
| Self-assessment |
Quarterly |
Internal checklist review |
| Internal audit |
Annually |
Compliance team review |
| External audit |
As needed |
Third-party assessment |
| Penetration testing |
Annually |
Security verification |
Improvement Process
| Step |
Action |
| 1 |
Identify gaps through assessments |
| 2 |
Prioritize by risk |
| 3 |
Develop remediation plan |
| 4 |
Implement changes |
| 5 |
Verify effectiveness |
| 6 |
Document improvements |
How Bastion Helps
Maintaining compliance requires ongoing attention and systematic processes.
| Challenge |
How We Help |
| Annual reviews |
Structured review process |
| Regulatory monitoring |
Alert on relevant changes |
| Training |
Educational programs for staff |
| Vendor management |
Oversight processes and tools |
| Documentation |
Compliance evidence management |
| Audits |
Internal and external assessment support |
Need help maintaining CCPA compliance? Talk to our team →
Sources
