{"id":774,"date":"2020-06-18T07:15:25","date_gmt":"2020-06-18T12:15:25","guid":{"rendered":"https:\/\/cmitsolutions.com\/boston-ma-1089\/?p=774"},"modified":"2023-03-23T23:15:18","modified_gmt":"2023-03-24T04:15:18","slug":"does-ccpa-apply-to-my-business","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/boston-ma-1089\/blog\/does-ccpa-apply-to-my-business\/","title":{"rendered":"Does CCPA Apply To My Business?"},"content":{"rendered":"

Is Your Business CCPA Compliant?<\/strong><\/h1>\n

The California Consumer Protection Act (CCPA<\/strong><\/span><\/a>) went into effect on January 1, 2020.\u00a0 In brief, \u201cthe CCPA grants California consumers robust data privacy rights and control over their personal information, including the right to know, the right to delete, and the right to opt-out of the sale of personal information that businesses collect, as well as additional protections for minors. [1]<\/span><\/strong><\/a>\u201d<\/p>\n

How Is It Different From GDPR?<\/strong><\/h2>\n

The CCPA is the first law in the US to define a broad set of rules designed to protect consumers and their data.\u00a0 While the specifics of the law vary from the GDPR<\/strong><\/span><\/a> in Europe, these laws share similar core principles.<\/p>\n

For California residents, the CCPA creates a bundle of rights concerning their data.\u00a0 Some of the key protections include \u201cthe right to know\u201d and \u201cthe right to say no.\u201d This means that those protected under this law will be able to see the data companies have gathered about them, data such deleted, and opt out from companies selling their data to third parties.<\/p>\n

Notably for businesses, this law can affect any company, regardless of where they reside if the company does business in California and meets certain other requirements listed below.<\/p>\n

Does CCPA Apply To My Company?<\/strong><\/h2>\n

The CCPA applies to any company (your company is a \u201ccovered business\u201d) if it operates in California collects the personal information of California residents, determines the purposes and means of processing that information, and one or more of the following applies:<\/p>\n

\u2022 The business has annual gross revenues in excess of $25 million<\/p>\n

\u2022 The business annually buys, receives for the business\u2019s commercial purposes, sells or shares for commercial\u00a0\u00a0 purposes the personal information of 50,000 or more consumers, households or devices; or<\/p>\n

\u2022 The business derives 50% or more of its annual revenues from selling consumers\u2019 personal information.<\/p>\n

For more details on determining whether this applies or not see this article<\/a><\/strong><\/span>.<\/p>\n

What Do I Need To Do?<\/strong><\/h2>\n

If you determine your company is a covered business, you should do the following:<\/p>\n

\"\"<\/p>\n

<\/h3>\n

Work with your legal team to update your contracts with vendors<\/strong>
\n<\/span><\/h3>\n

There\u2019s a lot of nuance to the changes you will need to make in order to be compliant with the CCPA.\u00a0 Vendors can be split into two sub-categories: service providers and third parties. Make sure you understand where your vendors may fall<\/a><\/span><\/strong> and how it applies to them.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Change your privacy policy to comply with the CCPA<\/strong>
\n<\/span><\/h3>\n

To comply, privacy policies must disclose:<\/p>\n

\u2022 Consumers\u2019 rights to access and delete personal data<\/p>\n

\u2022 Methods for requesting information about their data<\/p>\n

\u2022 The categories of personal data collected, sold or disclosed in the preceding 12 months<\/p>\n

\u2022 If consumer personal info is sold, the business must provide a link to a \u201cDo Not Sell My Personal Information\u201d website.<\/p>\n

\"\"
\nProvide a process for consumers handling requests access data, deletion of data and for opting out of data collection<\/strong><\/span><\/h3>\n

This may require extensive data mapping to understand where such data exists and how to find it and delete it.\u00a0 If processes do not currently exist, they will need to be developed.<\/p>\n

\"\"<\/p>\n

Employee Training<\/strong><\/span><\/h3>\n

The CCPA requires training for all individuals (staff) at a company that may handle personal data or inquiries about the company\u2019s privacy practices and other aspects of their privacy program.<\/p>\n

Transparency Is Key<\/strong><\/h2>\n

The CCPA provides comprehensive protections for California consumers. This extends to companies inside and outside of California, who meet certain requirements that are subject to the CCPA. If your company is a covered business be sure to take the steps necessary to comply with the new regulations. Consider how CCPA compliance fits into your privacy program and other such regulations such as the GDPR. Many processes for one regulation may help maintain compliance with other regulations. Because the CCPA is rapidly evolving, stay tuned for changes and make sure you understand how they may impact your business.<\/p>\n

Written by: Chris Zambuto<\/strong><\/span><\/a> | Chief Information Security Officer @<\/a><\/span><\/strong>CMITBostonCambridge<\/span><\/strong><\/a><\/p>\n

[1]<\/a> CCPA<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Is Your Business CCPA Compliant? The California Consumer Protection Act (CCPA) went…<\/p>\n","protected":false},"author":259,"featured_media":775,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28],"tags":[],"class_list":["post-774","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blog"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t