United States · Compliance
CCPA as amended by the CPRA compliance in the United States
Achieve CCPA as amended by the CPRA compliance in the US with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- New York office team
- Effivity software included
- Academy training included
Who asks for CCPA as amended by the CPRA in the US
Clients include
CCPA as amended by the CPRA compliance in the US at a glance
California Consumer Privacy Act, as amended by Proposition 24 (CPRA) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in the US ask for evidence that you meet it.
California's Attorney General describes the CCPA as giving consumers more control over the personal information businesses collect about them, and since Proposition 24, the CPRA, amended it, that control includes rights to correct inaccurate information and to limit the use of sensitive personal information. CPRA amends the CCPA rather than creating a separate law, which is why the Attorney General's office refers to the CCPA, as amended. Enforcement sits with the Attorney General and the California Privacy Protection Agency. There is no CCPA certificate: compliance is shown through accurate notices, working request handling for access, deletion, correction and opt-out, and contracts with service providers. Retailers, data-driven marketers, SaaS platforms, data brokers and businesses outside California that serve California consumers are typical clients. Many build on ISO/IEC 27701 to run privacy as a management system. Sterling maps the data, closes the gaps and trains the team, with Effivity and Sterling Academy included. Questions follow.
Who needs CCPA as amended by the CPRA in the US, and what happens without it
These are the organisations in the US that most often need to show CCPA as amended by the CPRA.
- Businesses handling California consumers' personal informationThe CCPA as amended gives consumers rights businesses must honour.
- Retailers and data-driven marketersOpt-out of sale or sharing, including via the GPC, applies.
- Data brokersThe Attorney General states the CCPA applies to many businesses, including data brokers.
- SaaS platforms acting as service providersBusiness customers require contractual and operational support for consumer requests.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkCCPA as amended by the CPRA requirements in the US
Strip away the vocabulary and the CCPA, as amended by the CPRA, asks a covered business to comply in six areas of consumer privacy.
In the US these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: CCPA as amended by the CPRA explained →
How to achieve CCPA as amended by the CPRA compliance in the US
One team from the New York office carries the work from scoping to sign-off. Delivered from the New York office across the US, with remote delivery for teams in other time zones and on-site work as agreed.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against CCPA as amended by the CPRA and the US requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does CCPA as amended by the CPRA compliance take in the US?
There is no standard duration: it depends on your scope and on how much of the system already runs. In the US these are the factors that set the timeline.
- Number of systems and data flows holding California consumers' data
- Whether a data inventory exists
- Volume and channels of consumer requests
- Number of service providers and contracts
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does CCPA as amended by the CPRA compliance cost in the US?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In the US these factors move both.
- Data mapping effort across systems
- Consent and opt-out tooling (including GPC handling)
- Contract remediation with service providers
- Training and request-handling procedures
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
CCPA as amended by the CPRA consultants and assessors in the US
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers CCPA as amended by the CPRA and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in the US are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive CCPA as amended by the CPRA in the US (2)
| Instrument | How it treats the standard |
|---|---|
| California Consumer Privacy Act, as amended by Proposition 24 (CPRA) | The instrument itself Consumer rights and business responsibilities; no certification. |
| California Privacy Protection Agency and Attorney General enforcement | Enforcement The Attorney General or the Agency may take legal action against non-compliant entities. |
Accreditation, audit language and remote audits in the US
Compliance, not certification: there is no CCPA certificate. Evidence is the business's notices, request-handling procedures and records, service-provider contracts and data inventory. ISO/IEC 27701 certification can support, not replace, that evidence. Edition and transition details: CCPA as amended by the CPRA hub →
Audit language
Notices and procedures in English (and other languages where the business serves consumers in them).
Remote and on-site
Data mapping and gap assessments can be largely remote; workshops on-site as agreed.
CCPA as amended by the CPRA in the US: questions clients ask
Is CPRA a separate law from the CCPA?
No. The California Attorney General states that the CPRA amends the CCPA and does not create a separate law, which is why businesses refer to the CCPA as amended. The amendments came through Proposition 24, approved by voters in November 2020. Confirm how the current text applies to you with your counsel.
Who enforces the CCPA?
Both the California Attorney General and the California Privacy Protection Agency. The Attorney General states that either of them may take legal action against entities that do not comply. If you are unsure whether the law reaches your business, ask your counsel or read the regulators' own guidance.
Is there a CCPA certification?
No. There is no CCPA certificate: the business itself evidences its compliance. ISO/IEC 27701 certification can support that evidence but does not stand in for it, so treat it as one useful input rather than proof. Where a customer or regulator asks, confirm what they accept with your counsel.
More on CCPA as amended by the CPRA for US organisations
Other standards US businesses ask Sterling for
Organisations in the US often combine CCPA as amended by the CPRA with one of these, under one management system where the scopes allow.
Start with a free discovery call from the New York office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- California Consumer Privacy Act, as amended by Proposition 24 (CPRA) — oag.ca.gov (accessed 5 Oct 2026)
- California Privacy Protection Agency and Attorney General enforcement — oag.ca.gov (accessed 5 Oct 2026)
- Higher-level contract quality requirements (FAR 46.202-4) — acquisition.gov (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice