CCPA and Sensitive Personal Information

Check business coverage and information categories

The CCPA, as amended by the CPRA, addresses personal information and defines sensitive personal information with additional rules. Use the statute and CPPA guidance to determine business coverage, exemptions and relevant rights. Do not equate the California categories with GDPR special categories or assume every California-related record is treated identically.

Sources: [1] [2]

Make the inventory useful for privacy decisions

Start with one collection process, such as account registration or customer support. Record the information collected, why it is used, retention decisions and recipients. Review exports, analytics work areas and support attachments alongside the main application.

Validate candidate findings with the business owner. An isolated identifier cannot tell the team whether a disclosure is a sale, sharing, a permitted service-provider transfer or another activity; that requires the actual business and contractual context.

Test request handling across copies

Use a safe sample to trace how a privacy request reaches the responsible team and which systems are checked. Record exceptions and decisions rather than silently ignoring a copy that is hard to find. Confirm that remediation does not remove evidence or records subject to a valid retention obligation.

Separate effective rules from phased compliance

CPPA adopted updates covering risk assessments, cybersecurity audits and automated decisionmaking technology, among other matters. Use the final regulations and the agency's timetable to decide which provisions apply. Assign owners to the relevant workstreams instead of describing every provision as newly mandatory for all businesses on the same date.

Sources: [2] [3]

Applying this with TRIAS

Evaluate TRIAS discovery and classification against the data categories in your approved California inventory. Test controls for selected sharing risks and review evidence access. Product findings support the privacy programme but do not determine legal coverage or fulfil consumer rights on their own.

• TRIAS and CCPA →
• Data discovery →