Law / United States / 
California
CCPA Regulations: training, record-keeping and metrics (article 8)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7100 to 7102
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Governance, Retention, Disclosure
As of .
What it requires
- Inform everyone responsible for handling consumer inquiries about your information practices or your CCPA compliance of all the requirements of the CCPA and the Regulations and how to direct consumers to exercise their rights (section 7100(a)).
- Maintain records of consumer requests and how you responded for at least 24 months, as a ticket or log with the date, nature and manner of the request, the date and nature of your response, and the basis for any denial, protected by reasonable security procedures and practices (section 7101).
- If you know or reasonably should know that you buy, receive, sell, share or otherwise make available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year, establish, document and comply with a training policy (section 7100(b)), compile the request metrics section 7102(a)(1) lists, and disclose them by July 1 of each year in your privacy policy or on your website through a link in it (section 7102(a)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Section 7100(a) of the CCPA Regulations requires all individuals responsible for handling consumer inquiries about a business's information practices or its compliance with the CCPA to be informed of all of the requirements in the CCPA and the Regulations and how to direct consumers to exercise their rights. Section 7101(a) requires a business to maintain records of consumer requests made under the CCPA and how it responded to them for at least 24 months.
Section 7102(a)(1) requires a business that handles the personal information of 10,000,000 or more consumers in a calendar year to compile metrics on the requests it received, complied with and denied. Section 7102(a)(2) requires a business that handles that volume of personal information to disclose the metrics by July 1 of every calendar year within its privacy policy or on its website through a link in its privacy policy. The Agency's regulations became effective on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.