CCPA/CPRA Compliance Checklist Template

What the CCPA Compliance Checklist Covers

1. 1
   Phase 1

   Phase 1: Applicability & Scope

   4 tasks

   The first task’s scope answers drive the conditional steps in Phases 4 to 7.

   • Run the applicability test and answer the scope questions — revenue, the 100,000 consumers or households test and data sales, then whether you sell or share, use ADMT or broker data
   • Carry forward last year’s open actions — each one closed with evidence, or re-dated with a reason and an owner
   • Bring workforce and business contact data into scope — the employee and B2B exemptions lapsed on 1 January 2023, so HR, recruiting and CRM systems are covered
   • Name an owner for each area — privacy, security, HR, marketing, procurement, and the executive who will sign certifications to the agency
2. 2
   Phase 2

   Phase 2: Data Map, Privacy Policy & Notices

   5 tasks

   • Map personal information by system and category — sources, purposes and recipients, and whether each disclosure is a sale, a share or a business purpose
   • Flag sensitive personal information in the map — including neural data, citizenship or immigration status and data of consumers known to be under 16
   • Record a retention period for each category — the notice at collection must state it, or the criteria used to set it
   • Update the privacy policy within 12 months of the last update — rights, request methods, and what was collected, sold, shared or disclosed
   • Walk every point of collection — web forms, apps, stores, call centres and job applications all give notice at or before collection
3. 3
   Phase 3

   Phase 3: Consumer Requests & Verification

   5 tasks

   • Test each request method end to end — two or more methods including a toll-free number, or email only for online-only businesses with a direct relationship
   • Sample closed requests against the clock — receipt confirmed within 10 business days and a response within 45 calendar days, or 90 with a notified reason
   • Check verification is proportionate — two data points for categories, three plus a signed declaration for specific pieces, and none for opt-outs
   • Test the extended right-to-know look-back — data back to 1 January 2022 supplied, or a detailed reason why it would be impossible or disproportionate
   • Publish request metrics if you reach 10 million consumers — last year’s counts by request type, posted by 1 July in or linked from the privacy policy
4. 4
   Phase 4

   Phase 4: Opt-Outs, Global Privacy Control & Sensitive Data

   6 tasks

   The first five tasks appear only when Phase 1 records that the business sells or shares personal information.

   • Test Global Privacy Control on the live site — with the signal on, tags that sell or share stop for that browser and any profile tied to it
   • Confirm the site shows the opt-out status — for example “Opt-Out Request Honored” or a toggle, as the 2026 regulations require
   • Check opt-outs take effect within 15 business days — including notice to third parties that received the data in the meantime
   • Compare the opt-out and opt-in paths — saying no takes no more steps than saying yes, and the banner offers both on equal terms
   • Wait 12 months before asking an opted-out consumer to opt back in — unless the consumer starts the request themselves
   • Limit sensitive data uses within 15 business days of a request — stop uses beyond the permitted purposes and instruct service providers to do the same
5. 5
   Phase 5

   Phase 5: Service Providers, Contractors & Third Parties

   5 tasks

   The last task appears only when Phase 1 records that the business is a data broker.

   • Classify every recipient in the data map — service provider, contractor or third party, since each needs different contract terms
   • Check contracts carry the required terms — specified purposes, no selling or sharing, notice if they cannot comply, and your right to stop misuse
   • Start with ad tech and analytics contracts — tags sharing data for cross-context behavioural advertising need third-party terms
   • Confirm vendors can action deletions and access requests — the regulations require their help; test one real request
   • Data brokers: confirm registration and DROP processing — register by 31 January and pull deletion requests from DROP at least every 45 days since 1 August 2026
6. 6
   Phase 6

   Phase 6: Risk Assessments & ADMT

   7 tasks

   The two ADMT tasks appear only when Phase 1 records ADMT use for significant decisions.

   • List processing that needs a risk assessment — selling or sharing, sensitive data, ADMT for significant decisions, profiling of workers or students, and training identification tools
   • Gate new high-risk processing on an assessment — required before launch since 1 January 2026, so build it into product and procurement sign-off
   • Schedule assessments for processing that predates 2026 — each one completed and documented by 31 December 2027
   • Track updates and retention — update within 45 days of a material change, review every three years, keep five years or while processing lasts
   • Prepare the first submission to the agency — assessments conducted in 2026 and 2027 are reported by 1 April 2028 under an executive’s attestation
   • ADMT: inventory tools used for significant decisions — lending, housing, education, hiring, work allocation and pay, and healthcare; compliance from 1 January 2027
   • ADMT: issue pre-use notices and opt-out or appeal routes — plus access requests answered on the 45-day clock
7. 7
   Phase 7

   Phase 7: Cybersecurity Audit, Training & Sign-Off

   6 tasks

   The first three tasks appear only when Phase 1 records that the business meets the cybersecurity audit test.

   • Confirm the first audit deadline — 1 April 2028 if 2026 revenue topped $100 million, 2029 for $50–100 million in 2027, 2030 below $50 million in 2028
   • Appoint a qualified, independent auditor — an internal auditor reports to an executive with no responsibility for the security programme
   • Plan the certification of completion — submitted on the agency’s website by 1 April, with audit documents kept for five years
   • Train everyone who handles privacy enquiries — support, HR and sales staff know where to route each request
   • Rate each finding and draft the review report — high, medium or low, with the legal reference, owner and due date
   • Obtain executive sign-off and diarise next year’s review — record accepted risks and who accepted them