Understand Your Obligations
Clarify applicability, roles, information flows and exemptions before defining the compliance work.
Ccpa / cpra compliance
Understand your data.
Respect consumer choices.
Build practical compliance.
Turn California privacy requirements into workable notices, consumer-rights processes and supplier controls. Cyber360 helps you assess CCPA applicability, identify gaps and build an accountable programme around your actual data practices.
Privacy & data protection • Practical controls. Clear accountability.
Understand → Improve → Validate
From questions to decisions
Make consumer privacy work beyond the policy.
Your notices, advertising tools, suppliers and request-handling teams need to tell the same story. We help connect what you collect and disclose with the choices you offer and the evidence you retain.
Make Choices Effective
Connect consumer-facing privacy controls with the systems and suppliers that must honour them.
Keep Evidence Current
Document decisions, responsibilities and improvements so the programme can adapt as practices change.
When it adds value
Focus effort where it can make a difference.
Serving California Consumers
Assess the relevance of CCPA thresholds, activities and exemptions to your business.
Using Advertising or Analytics Tools
Review data disclosures and whether sale or sharing obligations and opt-out mechanisms apply.
Improving Rights Handling
Bring request intake, fulfilment, supplier coordination and records into a reliable workflow.
Preparing for Regulatory Change
Identify applicable risk assessment, cybersecurity audit or automated decisionmaking requirements and compliance dates.
Service areas
Privacy translated into practical action.
These are examples for scoping, not an all-inclusive package. Technologies, delivery expertise, access requirements and outputs are confirmed before an engagement.
01
Applicability & Gap Assessment
Which requirements apply to your business?
- Example scope
- Business activities, statutory thresholds, roles, personal information and relevant exemptions.
- What we examine
- Existing controls and evidence against applicable CCPA requirements, as amended by CPRA.
- Evidence to take away
- An applicability record, gap report and prioritised remediation roadmap.
02
Personal Information Mapping
Can you trace collection, use and disclosure?
- Example scope
- Data sources, categories, sensitive personal information, purposes, retention, recipients and systems.
- What we examine
- Information flows, proportionality, retention practices and potential sale or sharing of information.
- Evidence to take away
- A data inventory and processing map with ownership and review actions.
03
Consumer-Rights Operations
Can consumers exercise their rights effectively?
- Example scope
- Know, delete, correct, opt-out, limit and equal-treatment requirements where applicable.
- What we examine
- Intake, verification where required, authorised agents, exceptions, deadlines and fulfilment records.
- Evidence to take away
- Request workflows, response templates and a tracking register.
04
Notices & Privacy Choices
Do notices and controls reflect actual practices?
- Example scope
- Privacy policies, notices at collection, opt-out methods and applicable sensitive-information choices.
- What we examine
- Clarity, accessibility, Global Privacy Control handling and alignment with downstream processing.
- Evidence to take away
- Notice updates and functional requirements for privacy-choice implementation.
05
Service Providers & Third Parties
Do contractual and operational responsibilities align?
- Example scope
- Service providers, contractors, third parties, data disclosures and relevant agreements.
- What we examine
- Role classification, contractual restrictions, due diligence and propagation of consumer requests.
- Evidence to take away
- A supplier review toolkit, agreement actions and oversight responsibilities.
06
Ongoing Compliance & Readiness
How will the programme keep pace?
- Example scope
- Evidence maintenance, staff awareness, change reviews and applicable additional regulatory duties.
- What we examine
- Risk assessment, audit and ADMT applicability, phased dates and dependencies; specialist work is separately scoped.
- Evidence to take away
- A compliance calendar, accountable action plan and readiness priorities.
How it works
From understanding to everyday accountability.
- 01
Confirm Applicability
Agree business context, roles, scope and relevant California privacy requirements.
- 02
Map the Practices
Document collection, use, retention, disclosure and supplier data flows.
- 03
Assess the Gaps
Review notices, rights handling, choice mechanisms, contracts and evidence.
- 04
Implement the Response
Develop agreed documentation and workflows, with system changes scoped and approved.
- 05
Validate Operation
Walk through requests and test agreed privacy-choice behaviour and hand-offs.
- 06
Maintain Accountability
Assign owners, retain evidence and review changes to practices and requirements.
What you receive
Clear enough to decide.
Detailed enough to act.
The reporting package is agreed around your audience and the decisions it needs to support.
For Leadership & Privacy Owners
- Applicability and gap assessment with prioritised actions.
- Personal information inventory and processing maps.
- Supplier review actions and assigned responsibilities.
- Compliance calendar and regulatory-readiness priorities.
For Operational & Delivery Teams
- Consumer-rights workflows, response templates and register.
- Privacy policy and notice-at-collection review actions.
- Opt-out and preference-signal implementation requirements.
- Evidence checklist, staff guidance and agreed validation records.
Meaningful progress
Track the improvement.
Keep the evidence.
Agree what completion means for each action: an approved design decision, a reviewed configuration, a resolved finding or a demonstrated process. Record owners, dependencies, exceptions and the evidence available.
Keep records, notices and risk decisions current. Review the programme when purposes, technologies, suppliers or jurisdictions change.
Preparing the engagement
Start with the right context.
01
Business & Applicability
- Describe your activities and California consumer relationships.
- Share relevant revenue, data-volume and role information for scoping.
02
Data & Disclosures
- Share inventories, notices, advertising tools and supplier agreements.
- Identify potential sale, sharing and sensitive-information uses.
03
Rights & Choices
- Provide request workflows, opt-out controls and existing records.
- Nominate privacy, legal, marketing, IT and procurement owners.
04
Delivery & Decisions
- Agree implementation, testing and regulatory-readiness work packages.
- Confirm approval routes and any specialist legal or audit support.
Reference guidance: California Privacy Protection Agency: laws and regulations. Relevant practices are selected for the agreed scope; applicability and evidence boundaries are agreed during scoping.
Clear boundaries
Know what the work establishes.
The engagement supports agreed activities, jurisdictions and evidence. Your organisation retains responsibility for processing decisions, legal obligations and control operation. Specialist legal opinions, formal audits, regulator representation and production implementation require explicit agreement.
Data Privacy & Protection
Build a broader privacy programme across the data lifecycle.
Explore the service →GDPR Compliance
Explore EU GDPR-focused governance and privacy operations.
Explore the service →PCI DSS Compliance
Strengthen payment-data security and validation readiness.
Explore the service →Practical questions
Before we get started.
Are CCPA and CPRA separate laws?
CPRA amended the CCPA, adding rights and obligations. We use CCPA / CPRA as a familiar service label and assess the CCPA as amended, together with applicable regulations.
Does every business with California customers qualify?
No. Applicability depends on the statutory definition, thresholds, activities and exemptions. We assess your circumstances and document the scope rather than assuming all organisations are covered.
Is a cookie banner enough?
No. A banner does not replace data mapping, accurate notices, rights fulfilment, contracts or applicable sale-and-sharing opt-outs. Privacy choices must connect with actual processing and relevant preference signals.
Do all businesses need audits and ADMT controls now?
No. Applicability criteria and phased compliance dates differ. We identify relevant obligations and planning priorities; formal audits, specialist assessments and system implementation require agreed scope.
Does GDPR compliance also satisfy CCPA?
No. Existing records and controls may be useful, but terminology, rights, applicability and obligations differ. A specific gap assessment is needed.
Does this guarantee compliance?
No. The service supports agreed assessment and implementation work. Your organisation remains responsible for its practices and legal obligations; specialist legal opinions and regulator representation are separately agreed.
Take a closer look
The service overview,
ready to share.
Download the Cyber360 CCPA / CPRA Compliance brochure for the service scope, engagement approach, deliverables and preparation guidance.
PDF · 4 pages · 520 KB
Your next step
Do your privacy choices match your data practices?
Tell us the decision you need to make. We’ll help define a useful scope.