Does the CCPA apply to your business? A plain-language check

Understanding ccpa small business requirements

The California Consumer Privacy Act (CCPA) is one of the strongest data privacy laws in the United States. It gives California residents the right to know what personal information businesses collect about them and how that information is used. While it was designed to target large tech companies, many smaller firms also fall under its scope. If you do business in California, you need to know if you are a ccpa small business.

The law was recently updated by the California Privacy Rights Act (CPRA), which added even more protections for consumers. Staying compliant means more than just having a privacy policy; it means having the systems in place to handle requests from your customers regarding their personal data.

Does the law apply to you?

Not every business has to follow the CCPA. The law applies to 'for-profit' entities that do business in California and meet at least one of these three thresholds:

• Your gross annual revenue is over 25 million dollars.
• You buy, sell, or share the personal information of 100,000 or more California residents or households.
• You get 50% or more of your annual revenue from selling or sharing California residents' personal information.

What rights do consumers have?

If your business is covered by the CCPA, your customers (who are California residents) have several important rights. You must be prepared to honor these requests, usually within 45 days. Failing to respond or denying these rights can lead to significant penalties from the California Privacy Protection Agency.

1. Right to Know: Customers can ask what specific pieces of personal data you have collected about them.
2. Right to Delete: Customers can ask you to delete the personal information you have collected, with some exceptions.
3. Right to Opt-Out: Customers can tell you to stop selling or sharing their personal information with others.
4. Right to Correct: Customers can ask you to fix inaccurate personal information that you hold.
5. Right to Non-Discrimination: You cannot charge a different price or provide a different level of service because a customer exercised their privacy rights.

Updating your website and privacy policy

To be compliant, your website must be updated. You need a clear link, often in the footer, that says 'Do Not Sell or Share My Personal Information.' This link should take the user to a page where they can easily submit their request. Your privacy policy must also be updated to describe the categories of data you collect and how consumers can exercise their rights.

Data mapping and inventory

To fulfill a 'Right to Know' or 'Right to Delete' request, you must first know where all your customer data is. This process is called data mapping. You need to track data as it moves from your website to your CRM, your email marketing tool, and your billing system. For a ccpa small business, this is often the most time-consuming part of compliance, but it is essential for accuracy.

Security requirements under CCPA

While the CCPA is primarily a privacy law, it also has a 'private right of action' for data breaches. This means that if you fail to maintain reasonable security procedures and a breach occurs, California residents can sue you for damages. This makes strong cybersecurity, such as encryption and multi-factor authentication, a legal necessity rather than just a best practice.