ccpa-compliance-check

name	ccpa-compliance-check
enabled	true
description	Use when performing ccpa compliance check — evaluates organizational compliance with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Covers consumer rights implementation, data inventory, privacy notice requirements, vendor management, opt-out mechanisms, and data protection assessments.
required_connections	[{"prefix":"grc-tool","label":"GRC Platform"}]
config_fields	[{"key":"organization_name","label":"Organization Name","required":true,"placeholder":"e.g., Acme Corp"},{"key":"data_subjects_count","label":"Approximate California Consumer Count","required":true,"placeholder":"e.g., 100,000"},{"key":"data_categories","label":"Primary Personal Information Categories","required":false,"placeholder":"e.g., contact info, purchase history, browsing data"}]
features	["COMPLIANCE","PRIVACY","CCPA"]

CCPA/CPRA Compliance Check

Phase 1: Applicability Assessment

1. Determine CCPA/CPRA applicability
   • Annual gross revenue > $25 million
   • Buy/sell/share personal info of 100,000+ consumers/households
   • Derive 50%+ of revenue from selling/sharing personal info
2. Identify all business entities in scope
3. Determine if acting as business, service provider, or contractor
4. Identify any exemptions applicable (employee data, B2B, etc.)

Phase 2: Data Inventory & Mapping

1. Catalog personal information collected
   • Identifiers (name, email, SSN, IP address)
   • Commercial information (purchase history)
   • Internet/network activity (browsing, search history)
   • Geolocation data
   • Professional/employment information
   • Education information
   • Inferences drawn from above
   • Sensitive personal information
2. Document data sources, purposes, and retention periods
3. Map data flows to third parties and service providers
4. Identify data sold or shared for cross-context behavioral advertising

Data Mapping Summary

Category	Sources	Purpose	Shared With	Sold	Retention
Identifiers				Yes/No
Commercial				Yes/No
Internet activity				Yes/No
Geolocation				Yes/No
Sensitive PI				Yes/No

Phase 3: Consumer Rights Implementation

1. Assess consumer rights mechanisms
   • Right to Know (access requests)
   • Right to Delete
   • Right to Correct
   • Right to Opt-Out of Sale/Sharing
   • Right to Limit Use of Sensitive PI
   • Right to Non-Discrimination
   • Right to data portability
2. Verify request submission methods (minimum 2 methods required)
3. Test request fulfillment within 45-day timeline
4. Verify identity verification procedures
5. Assess authorized agent request handling

Rights Compliance Matrix

Right	Mechanism Exists	Process Documented	Tested	Timeline Met	Compliant
Know/Access	[ ]	[ ]	[ ]	[ ]	[ ]
Delete	[ ]	[ ]	[ ]	[ ]	[ ]
Correct	[ ]	[ ]	[ ]	[ ]	[ ]
Opt-Out Sale/Share	[ ]	[ ]	[ ]	[ ]	[ ]
Limit Sensitive PI	[ ]	[ ]	[ ]	[ ]	[ ]

Phase 4: Privacy Notice Review

1. Review privacy policy for required disclosures
   • Categories of PI collected in past 12 months
   • Purposes for each category
   • Categories of third parties PI shared with
   • Consumer rights description
   • "Do Not Sell or Share My Personal Information" link
   • "Limit the Use of My Sensitive Personal Information" link
   • Updated within past 12 months
2. Verify notice at collection is provided
3. Review financial incentive notices if applicable
4. Assess cookie banner and GPC signal handling

Phase 5: Vendor & Service Provider Management

1. Review service provider and contractor agreements
   • Written contract with CCPA-required terms
   • Purpose limitations specified
   • Prohibition on selling/sharing received PI
   • Obligation to assist with consumer requests
   • Right to audit compliance
2. Assess third-party data sharing agreements
3. Verify data processing agreements are current

Phase 6: Data Protection Assessment

1. Evaluate security measures for personal information
2. Assess data minimization practices
3. Review data retention and deletion schedules
4. Verify breach notification procedures
5. Conduct risk assessment for high-risk processing (CPRA requirement)

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

• Applicability Determination: Criteria met and entities in scope
• Data Inventory: Complete PI catalog with flows and purposes
• Rights Assessment: Compliance status per consumer right
• Privacy Notice Gap Analysis: Required vs. current disclosures
• Remediation Plan: Prioritized actions with timelines

Action Items

• Complete personal information data mapping
• Implement missing consumer rights mechanisms
• Update privacy policy with all required disclosures
• Review and update service provider agreements
• Implement opt-out signal handling (GPC)
• Conduct annual data protection assessment
• Train staff on CCPA request handling procedures