California privacy operations guide

Which California workflow applies?

Consumer requests, processing risk assessments and DROP are separate workflows. Record the organization, data and activity before selecting one.

The CPPA approved regulations are binding within their scope. The DOJ consumer explanation does not replace the operative text.

A tool selection cannot establish coverage. Keep the scope decision and any unresolved facts with the responsible reviewer.

Worked example. One business, three possible jobs

Fictional example. Harbour Retail receives a request to know while planning an advertising-data sharing project. Its supplier describes itself as a data broker.

Create a consumer-request record. Open a separate assessment for the proposed sharing after confirming coverage under California regulations section 7150.

Do not infer that Harbour itself is a data broker from its supplier relationship. Assign that scope question for review.

Use separate owners and references. Link shared system evidence without merging clocks, assessment decisions or deletion-status reporting.

For the request, preserve receipt first. For proposed processing, resolve the assessment route before treating launch as approved.

Start with scope and the exact job

Separate the organization-level CCPA scope decision from the task being performed. A risk assessment, a consumer request and DROP readiness use different evidence and deadlines.

Record the source, owner, decision date and unresolved facts. Do not turn an incomplete intake into a legal conclusion.

Build evidence that another reviewer can follow

Keep the activity, purpose, data categories, affected people, recipients, safeguards and residual questions visible. Link each finding to the supplied evidence and the current official source.

• One stable assessment or request reference
• A dated source and rule version
• An owner and next action for every open item
• A record of delivery, correction or escalation

Do not merge separate California routes

DROP is a data broker deletion mechanism. It is not a general substitute for every CCPA request route. A risk assessment is also not a consumer response.

Use separate linked records when one event activates more than one route.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Name the precise request or activity and its first receipt or intended start date.
• Record the applicable provision, source version and scope decision.
• Identify systems, recipients and evidence locations.
• Assign each missing fact to an owner and next action.
• Keep response delivery, assessment approval and DROP processing evidence separate.

• Fictional California deadline report PDF. Inspect the clock, assumptions and evidence presentation before entering your own case.
• Fictional CCPA assessment PDF. Complete fictional pack (ZIP). Inspect supplied facts, assessment fields and unresolved review.
• Fictional DROP readiness PDF. Complete fictional pack (ZIP). Inspect readiness questions and actions. This is not proof of a completed deletion.