CCPA/CPRA Compliance Checklist Template

Phase 1: Applicability & Scope

The first task’s scope answers drive the conditional steps in Phases 4 to 7.

• Run the applicability test and answer the scope questions — revenue, the 100,000 consumers or households test and data sales, then whether you sell or share, use ADMT or broker data
• Carry forward last year’s open actions — each one closed with evidence, or re-dated with a reason and an owner
• Bring workforce and business contact data into scope — the employee and B2B exemptions lapsed on 1 January 2023, so HR, recruiting and CRM systems are covered
• Name an owner for each area — privacy, security, HR, marketing, procurement, and the executive who will sign certifications to the agency

Phase 2: Data Map, Privacy Policy & Notices

• Map personal information by system and category — sources, purposes and recipients, and whether each disclosure is a sale, a share or a business purpose
• Flag sensitive personal information in the map — including neural data, citizenship or immigration status and data of consumers known to be under 16
• Record a retention period for each category — the notice at collection must state it, or the criteria used to set it
• Update the privacy policy within 12 months of the last update — rights, request methods, and what was collected, sold, shared or disclosed
• Walk every point of collection — web forms, apps, stores, call centres and job applications all give notice at or before collection

Phase 3: Consumer Requests & Verification

• Test each request method end to end — two or more methods including a toll-free number, or email only for online-only businesses with a direct relationship
• Sample closed requests against the clock — receipt confirmed within 10 business days and a response within 45 calendar days, or 90 with a notified reason
• Check verification is proportionate — two data points for categories, three plus a signed declaration for specific pieces, and none for opt-outs
• Test the extended right-to-know look-back — data back to 1 January 2022 supplied, or a detailed reason why it would be impossible or disproportionate
• Publish request metrics if you reach 10 million consumers — last year’s counts by request type, posted by 1 July in or linked from the privacy policy

Phase 4: Opt-Outs, Global Privacy Control & Sensitive Data

The first five tasks appear only when Phase 1 records that the business sells or shares personal information.

• Test Global Privacy Control on the live site — with the signal on, tags that sell or share stop for that browser and any profile tied to it
• Confirm the site shows the opt-out status — for example “Opt-Out Request Honored” or a toggle, as the 2026 regulations require
• Check opt-outs take effect within 15 business days — including notice to third parties that received the data in the meantime
• Compare the opt-out and opt-in paths — saying no takes no more steps than saying yes, and the banner offers both on equal terms
• Wait 12 months before asking an opted-out consumer to opt back in — unless the consumer starts the request themselves
• Limit sensitive data uses within 15 business days of a request — stop uses beyond the permitted purposes and instruct service providers to do the same

Phase 5: Service Providers, Contractors & Third Parties

The last task appears only when Phase 1 records that the business is a data broker.

• Classify every recipient in the data map — service provider, contractor or third party, since each needs different contract terms
• Check contracts carry the required terms — specified purposes, no selling or sharing, notice if they cannot comply, and your right to stop misuse
• Start with ad tech and analytics contracts — tags sharing data for cross-context behavioural advertising need third-party terms
• Confirm vendors can action deletions and access requests — the regulations require their help; test one real request
• Data brokers: confirm registration and DROP processing — register by 31 January and pull deletion requests from DROP at least every 45 days since 1 August 2026

Phase 6: Risk Assessments & ADMT

The two ADMT tasks appear only when Phase 1 records ADMT use for significant decisions.

• List processing that needs a risk assessment — selling or sharing, sensitive data, ADMT for significant decisions, profiling of workers or students, and training identification tools
• Gate new high-risk processing on an assessment — required before launch since 1 January 2026, so build it into product and procurement sign-off
• Schedule assessments for processing that predates 2026 — each one completed and documented by 31 December 2027
• Track updates and retention — update within 45 days of a material change, review every three years, keep five years or while processing lasts
• Prepare the first submission to the agency — assessments conducted in 2026 and 2027 are reported by 1 April 2028 under an executive’s attestation
• ADMT: inventory tools used for significant decisions — lending, housing, education, hiring, work allocation and pay, and healthcare; compliance from 1 January 2027
• ADMT: issue pre-use notices and opt-out or appeal routes — plus access requests answered on the 45-day clock