California DROP readiness checklist
DROP readiness requires more than an account. The data broker needs an owned process for receipt, matching, deletion, suppression and evidence.
Confirm that DROP is the right route
Record the data broker registration position and the facts supporting it. Keep the conclusion separate from the operational readiness check.
Map receipt to verified action
Document who retrieves requests, how identifiers are matched, how deletion reaches systems and suppliers, and how suppression prevents avoidable reacquisition.
- Account and access owner
- Request retrieval evidence
- Matching and exception record
- Deletion and supplier confirmation
- Suppression and audit evidence
Test the route before relying on it
Use a synthetic request through the complete operating route. Record failures, retries, completion evidence and the owner of each corrective action.
Material reviewed for this guide
- Data Broker Registration and Accessible Deletion Mechanism RegulationsCalifornia Privacy Protection Agency
- California privacy regulationsCalifornia Privacy Protection Agency
This guide is general operational information, not legal advice. Check the official material and obtain appropriate advice for circumstances outside the stated scope.