CCPA compliance consulting for Californians' data handled the way the law expects.

What it is

What is the CCPA and what does it require?

The California Consumer Privacy Act is the state law, found in the California Civil Code from section 1798.100 onwards, that gives California residents control over the personal information businesses hold about them. It sets what a business must disclose and which requests it must honour, and lets people stop the sale or sharing of their data.

Voters strengthened it through Proposition 24, the California Privacy Rights Act, approved in November 2020. The CPRA added new protections, which took effect on 1 January 2023, and created the California Privacy Protection Agency to implement and enforce the law alongside the Attorney General.

This page covers California only. Other US state privacy laws have a page of their own.

Current position. The CPPA Board adopted a new regulation package on 24 July 2025, approved by the Office of Administrative Law on 22 September 2025 and in effect from 1 January 2026. It updates the existing rules and adds cybersecurity audits, risk assessments and duties for automated decisionmaking technology (ADMT), each on its own dated timetable.

Who it is for

Who needs to comply with the CCPA?

The Act reaches for-profit businesses doing business in California that meet any one of three conditions: annual gross revenue above the level the law sets; purchasing, selling or sharing the personal information of 100,000 or more California residents or households; or earning half or more of annual revenue from selling or sharing it. Head office location does not settle the question. Organisations usually come to Sterling for one of four reasons:

• A US customer's questionnaire asks about it. Enterprise buyers ask how you handle California requests, opt-outs and service-provider terms, and expect documents, not assurances.
• A contract or tender makes you a service provider. BPOs, software firms and agencies processing data for California businesses sign the terms the Act expects and help answer consumer requests.
• The regulator's timetable has arrived. Risk assessments, ADMT duties and cybersecurity audits each carry dates, and each needs an owner.
• Your group works to the GDPR and assumed that was enough. The opt-out model, the specific links and the request timelines differ, and a European programme needs a Californian layer.

Requirements

What are the main CCPA requirements?

The Act and the CPPA regulations have no management-system clause structure. What a business must do falls into the requirement areas below, summarised at title level; your programme is checked against the statute and the regulations in force during the gap analysis, with your legal advisers.

• Notice at collection and privacy policy: state the categories of personal information collected and the purpose of each, and publish a policy describing online and offline practices.
• Consumer rights: honour the rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, without discriminating against anyone who uses them.
• Request handling: verify the requester and respond within 45 calendar days, extendable once by a further 45 with notice.
• Opt-out links and signals: provide the "Do Not Sell or Share" and "Limit the Use" links where they apply, and treat Global Privacy Control as a valid opt-out.
• Children's information: obtain opt-in before selling or sharing, from a parent or guardian for children under 13.
• Service providers and contractors: put the required contract terms in place and make sure they support consumer requests.
• Reasonable security: protect personal information with security procedures and practices suited to it; breaches of unencrypted data caused by poor security can be litigated.
• Risk assessments: assess processing that presents significant risk, from 1 January 2026, with a first submission to the CPPA due by 1 April 2028.
• Cybersecurity audits: where processing presents significant risk to consumers' security, an annual audit, with certifications due to the CPPA from 1 April 2028 to 1 April 2030, phased by business size.
• Automated decisionmaking technology: from 1 January 2027, a pre-use notice, an opt-out and access to information where ADMT makes significant decisions about finance, housing, education, employment or healthcare.

Compliance process

How do you achieve CCPA compliance?

No body issues a CCPA certificate. Compliance is a condition you maintain and demonstrate when asked. Sterling builds and runs the programme with you; judgement on compliance belongs to the CPPA, the Attorney General and, ultimately, the courts.

1. 01
   Confirm whether and how the Act applies.Test the three conditions and settle your role for each data flow: business, service provider or contractor.
2. 02
   Gap analysis: compare current practice with the Act and regulations.Map data, trackers and suppliers; test notices, links, requests, contracts and security; agree actions, owners and dates.
3. 03
   Implement and record as you go.Rewrite notices, wire up opt-out links and signal handling, sign service-provider terms, set request procedures, complete the risk assessments due and train the people who handle requests.
4. 04
   Audit, review and close the findings.An internal audit tests requests, opt-outs and records end to end; management review decides the fixes, and we raise the findings first.
5. 05
   Keep evidence ready and keep it current.Answer customer questionnaires and regulator inquiries from the evidence file, prepare the risk-assessment submission and cybersecurity audit on the regulations' timetable, and update the programme as rules change.

Check the route before you sign. Anyone offering a "CCPA certificate" is selling something the law does not provide. Ask who maps the data, who tests the opt-outs and where the evidence will live; the submissions and certifications sent to the CPPA remain the business's own. The certification buyer's checklist

Cost

What drives the cost of CCPA compliance?

The cost depends less on headcount than on how much Californian data you touch and how many systems and partners it passes through. Once those are understood, the proposal is fixed.

Timeline

How long does CCPA compliance take?

Most programmes take three to six months to reach a defensible position; risk assessments and cybersecurity audits then run on the regulator's own dates, carried as milestones in Effivity.

Share your customer or board deadline at the start and we will say plainly what fits inside it.

Your engagement

What your CCPA engagement includes

Sterling OS™ structures the work. Choose Design™, where we guide and your team builds, or Drive™, where we manage and build with your people; they are alternative support levels, not stages. Sustain™ keeps the programme current after it is in place, and Automate™ is Effivity, where it runs. Sterling does not certify, attest or give legal advice; we work alongside your legal advisers.

• Applicability review and gap analysis

  Role, scope and a prioritised plan with owners and dates.

• Notices, policies and procedures

  Written for your data flows, reviewed with your counsel.

• Effivity ISO & GRC software

  Inventory, requests and assessments in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  Findings closed with evidence.

• Regulation readiness

  Risk assessments and cybersecurity audit preparation on the CPPA's timetable.

Enforcement decisions rest with the CPPA, the Attorney General and the courts; no certificate is issued.

Often combined with

Standards organisations pair with CCPA / CPRA

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
• Data Privacy Act (Philippines)Philippine Data Privacy Act compliance consulting: DPO, privacy impact assessments, security and 72-hour breach handling, from our office in Manila.